Live right now
Finished, tested and free to use. No sign-up wall in front of any of them.
A small collection of utilities I've built and put here to use freely. No accounts, no tracking beyond what's already on my site (Privacy Policy) - everything below runs in your browser unless stated otherwise. Each one doubles as a small case study in how I build things.
Finished, tested and free to use. No sign-up wall in front of any of them.
Mapped out and listed below, built in the order I actually need them.
Every live tool works client-side. Nothing you paste in is uploaded anywhere.
No login, no email capture, no licence key. Open the page and use it.
The next set is the part of my day job I get asked about most: how you plan a phishing programme, how you track whether awareness work is landing and how you tell where your own culture sits without paying someone to tell you.
Three of the fourteen below are those tools. They will work the same way as everything else here, in the browser, with nothing sent anywhere and nothing to sign up for.
The small jobs that come up constantly. Identifying a hash, sizing a subnet, reading a log faster, checking whether a site set its headers properly.
Generate SHA-1, SHA-256, SHA-384, SHA-512 and MD5 from text, or paste a hash and get its likely algorithm from length and format.
Entropy and a rough crack-time estimate for a password or passphrase, worked out on the page so nothing you type ever leaves it.
Network address, broadcast, usable host range and mask from a CIDR block. The calculator I always end up searching for.
Paste raw log output and it marks up IPs, timestamps, status codes and the indicators worth a second look.
Enter a URL and get a quick read on CSP, HSTS and the rest of the response headers. A light version of what I use at work.
An interactive pass over verification levels, 2FA requirements and the permission mistakes that keep showing up on real servers.
The three in build. Programme work rather than technical work, which is the side of security I spend most of my time on.
Plan a year of simulations: difficulty spread, audience splits, blackout dates and the follow-up training each wave triggers.
Track reporting rates, click rates and engagement across a campaign, then see whether the trend is actually moving or just noisy.
Answer a short set of questions about your programme and get a maturity read across governance, training, reporting and leadership buy-in.
Planning and reporting jobs that usually end up as a spreadsheet nobody enjoys maintaining. These export cleanly and can carry your own branding.
Two modes: a quick Discord-formatted schedule, or a full corporate roster with shift times, breaks, lunch and working-from-home tracking.
Log hours per project against a weekly requirement, brand it with your company logo and colour, then export the finished sheet.
Map a role hierarchy and its permission set visually before you touch the live system, then export the whole thing as a table.
Utilities that came out of building things for game servers and side projects. They are here because I use them myself.
Build and preview an embed visually, copy the raw JSON out, or fire a test straight at your own webhook URL.
Punch in an address and port, see whether the server is up and how many players are on it. Built from years of running these.
Test a pattern against sample text with live match highlighting, plus a shortlist of the patterns I reach for most often.
Paste a cron expression and get a plain-English answer on when it actually runs, plus the next few fire times.
Check a foreground and background pair against AA and AAA contrast ratios. This is what I used to sanity-check this very site.
Rough monthly cost of keeping a project alive: VPS, bot hosting, domain, storage. So you know what you are signing up for.
If there is a tool you keep rebuilding by hand, tell me. The roadmap above is just the things I have needed myself, so a good suggestion tends to jump the queue.