Server Config

These tools cover the checks worth doing before you apply a change to a web server. You can generate an .htpasswd file for basic authentication, validate .htaccess syntax, review a Content-Security-Policy declaration, audit the security headers a live site returns, decode a pasted PEM-format SSL/TLS certificate to inspect its subject, validity period, and SAN entries, and decode a CSR (Certificate Signing Request) before submitting it to a CA.

.htpasswd File Generator

Generate .htpasswd files for Apache and Nginx Basic Authentication securely in your browser. Supports bcrypt, APR1-MD5, and SHA-1. Passwords are never sent to the server.

CSP Header Validator

Paste a Content-Security-Policy header value to validate its directives and source values in one pass. Detects risky settings like unsafe-inline, a missing default-src fallback, and typos in directive names, and shows ev...

Security Headers Checker

Enter any site URL to check whether key security headers such as HSTS, CSP, and X-Frame-Options are properly configured. See which headers are missing or weak, along with tips for fixing each one.

SSL Certificate Decoder (X.509)

Paste a PEM-format SSL/TLS certificate to instantly decode its subject, issuer, validity period, SAN, serial number, public key algorithm, and SHA-1/SHA-256 fingerprints. Free tool that also works offline with self-signe...

CSR Decoder (Certificate Signing Request)

Decode a PEM CSR (Certificate Signing Request) instantly to review the CN, SAN, organization, and public key algorithm before submitting to a CA. Free, no signup.

.htaccess Syntax Checker

Paste the contents of an .htaccess file to instantly catch common mistakes: unclosed block tags, misspelled directive names, RewriteRule with too few arguments, and dangling RewriteCond lines.