[
  {"slug":"security-header-analyzer","category":"Website defence","title":"Security Header Analyzer","summary":"Review pasted HTTP response headers against current browser-security controls without sending data anywhere.","checks":["CSP, HSTS and MIME-sniffing protection","Framing, referrer and permissions controls","Cross-origin isolation and information-disclosure headers"],"source":"https://developer.mozilla.org/en-US/observatory/docs/tests_and_scoring","sourceLabel":"MDN HTTP Observatory methodology","keywords":"security headers checker, HTTP headers analyzer, CSP HSTS checker"},
  {"slug":"csp-analyzer","category":"Website defence","title":"Content Security Policy Analyzer","summary":"Parse a Content-Security-Policy value, identify risky source expressions and explain missing defence-in-depth directives.","checks":["unsafe-inline, unsafe-eval and wildcard sources","Script, object, base, frame and form restrictions","Nonce, hash and reporting signals"],"source":"https://cheatsheetseries.owasp.org/cheatsheets/Content_Security_Policy_Cheat_Sheet.html","sourceLabel":"OWASP Content Security Policy Cheat Sheet","keywords":"CSP analyzer, content security policy checker, CSP validator"},
  {"slug":"csp-generator","category":"Website defence","title":"Content Security Policy Generator","summary":"Build a conservative CSP starting point for a static site, web application or API endpoint.","checks":["Profile-based safe baseline","Validated source-list inputs","Enforcement and Report-Only header output"],"source":"https://cheatsheetseries.owasp.org/cheatsheets/Content_Security_Policy_Cheat_Sheet.html","sourceLabel":"OWASP Content Security Policy Cheat Sheet","keywords":"CSP generator, content security policy builder, CSP header generator"},
  {"slug":"cookie-security-analyzer","category":"Website defence","title":"Cookie Security Analyzer","summary":"Review one or more Set-Cookie lines for Secure, HttpOnly, SameSite and prefix requirements.","checks":["Secure, HttpOnly and SameSite attributes","__Host- and __Secure- prefix rules","Domain, path and cross-site cookie signals"],"source":"https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Set-Cookie","sourceLabel":"MDN Set-Cookie reference","keywords":"cookie security checker, Set-Cookie analyzer, SameSite checker"},
  {"slug":"cors-policy-analyzer","category":"Website defence","title":"CORS Policy Analyzer","summary":"Inspect pasted CORS response headers and flag combinations that are invalid or unnecessarily broad.","checks":["Allowed origin and credentials interaction","Methods, exposed headers and preflight age","Context-aware limitations on origin reflection"],"source":"https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/CORS","sourceLabel":"MDN CORS guide","keywords":"CORS checker, CORS policy analyzer, access control allow origin test"},
  {"slug":"permissions-policy-builder","category":"Website defence","title":"Permissions Policy Builder","summary":"Create a browser Permissions-Policy header that disables or limits sensitive device capabilities.","checks":["Camera, microphone and geolocation defaults","Payment, USB and display capture restrictions","Locked-down or same-origin profiles"],"source":"https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Permissions-Policy","sourceLabel":"MDN Permissions-Policy reference","keywords":"permissions policy generator, browser permissions header builder"},
  {"slug":"referrer-policy-advisor","category":"Website defence","title":"Referrer Policy Advisor","summary":"Choose a privacy-appropriate Referrer-Policy and preview what information it shares across origins.","checks":["Privacy level and analytics trade-off","Same-origin and cross-origin behaviour","Ready-to-copy HTTP and HTML configuration"],"source":"https://developer.mozilla.org/en-US/docs/Web/Security/Practical_implementation_guides/Referrer_policy","sourceLabel":"MDN Referrer Policy guidance","keywords":"referrer policy checker, referrer policy generator, privacy header"},
  {"slug":"html-security-auditor","category":"Source review","title":"HTML Security Auditor","summary":"Statically inspect pasted HTML for common browser-side security hazards without executing it.","checks":["Insecure URLs, frames and new-tab links","Inline handlers and dynamic-code indicators","Meta refresh and CSP delivery signals"],"source":"https://cheatsheetseries.owasp.org/cheatsheets/HTML5_Security_Cheat_Sheet.html","sourceLabel":"OWASP HTML5 Security Cheat Sheet","keywords":"HTML security scanner, HTML code security checker, static HTML audit"},
  {"slug":"mixed-content-scanner","category":"Source review","title":"Mixed Content Scanner","summary":"Find HTTP resources, form actions, media and CSS URLs that can undermine an HTTPS page.","checks":["src, href, action and poster attributes","srcset candidates and CSS url() values","Exact source locations with deduplication"],"source":"https://developer.mozilla.org/en-US/docs/Web/Security/Defenses/Mixed_content","sourceLabel":"MDN Mixed Content guidance","keywords":"mixed content checker, HTTP resource scanner, HTTPS page audit"},
  {"slug":"third-party-script-inspector","category":"Source review","title":"Third-Party Script Inspector","summary":"Inventory external and inline scripts in pasted HTML and highlight integrity and loading controls.","checks":["External script hosts","SRI and crossorigin attributes","async, defer, module and inline-script signals"],"source":"https://developer.mozilla.org/en-US/docs/Web/Security/Defenses/Subresource_Integrity","sourceLabel":"MDN Subresource Integrity guidance","keywords":"third party script checker, external script audit, SRI checker"},
  {"slug":"secure-form-reviewer","category":"Source review","title":"Secure Form Reviewer","summary":"Review HTML forms for insecure transport, sensitive GET submissions and credential-handling signals.","checks":["Form action scheme and method","Password and payment-field handling","CSRF-token indicators with explicit limitations"],"source":"https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html","sourceLabel":"OWASP CSRF Prevention Cheat Sheet","keywords":"form security checker, HTML form audit, CSRF form checker"},
  {"slug":"sri-hash-generator","category":"Source review","title":"Subresource Integrity Hash Generator","summary":"Create SHA-384 or SHA-512 integrity metadata for a local script, stylesheet or pasted resource body.","checks":["Exact bytes hashed locally","Standards-compatible base64 digest","Ready-to-copy script and link attributes"],"source":"https://developer.mozilla.org/en-US/docs/Web/Security/Defenses/Subresource_Integrity","sourceLabel":"MDN Subresource Integrity guidance","keywords":"SRI hash generator, integrity attribute generator, SHA384 SRI"},
  {"slug":"file-checksum","category":"Cryptography","title":"File Checksum Calculator","summary":"Calculate and optionally verify SHA-256, SHA-384 or SHA-512 for a local file.","checks":["File remains on the device","Exact hexadecimal digest","Constant-form comparison with a trusted checksum"],"source":"https://developer.mozilla.org/en-US/docs/Web/API/SubtleCrypto/digest","sourceLabel":"MDN Web Crypto digest reference","keywords":"file checksum calculator, SHA256 file hash, verify file checksum"},
  {"slug":"text-hash-generator","category":"Cryptography","title":"Text Hash Generator","summary":"Generate SHA-256, SHA-384 or SHA-512 for UTF-8 text entirely in the browser.","checks":["Explicit UTF-8 encoding","Hex and base64 output","Modern SHA-2 algorithms only"],"source":"https://developer.mozilla.org/en-US/docs/Web/API/SubtleCrypto/digest","sourceLabel":"MDN Web Crypto digest reference","keywords":"text hash generator, SHA256 online local, SHA512 calculator"},
  {"slug":"hmac-generator","category":"Cryptography","title":"HMAC Generator and Verifier","summary":"Generate or compare an HMAC using a local secret and the Web Crypto API.","checks":["HMAC-SHA-256, 384 and 512","Hex output and optional comparison","Secret is never submitted or stored"],"source":"https://developer.mozilla.org/en-US/docs/Web/API/SubtleCrypto/sign","sourceLabel":"MDN Web Crypto sign reference","keywords":"HMAC generator, HMAC SHA256 checker, message authentication code"},
  {"slug":"password-strength-checker","category":"Identity","title":"Password Strength Checker","summary":"Use a transparent, length-first heuristic aligned with current NIST guidance rather than invented crack-time claims.","checks":["Length and common-value screening","Repetition and predictable sequence signals","Single-factor and MFA length guidance"],"source":"https://pages.nist.gov/800-63-4/sp800-63b.html","sourceLabel":"NIST SP 800-63B-4","keywords":"password strength checker, NIST password checker, secure password test"},
  {"slug":"password-generator","category":"Identity","title":"Secure Password Generator","summary":"Create an unbiased password with cryptographically strong browser randomness and selected character sets.","checks":["Rejection-sampled random selection","At least one character from each chosen set","Optional removal of ambiguous characters"],"source":"https://developer.mozilla.org/en-US/docs/Web/API/Crypto/getRandomValues","sourceLabel":"MDN cryptographic randomness reference","keywords":"secure password generator, random password maker, browser password generator"},
  {"slug":"passphrase-generator","category":"Identity","title":"Local Passphrase Generator","summary":"Generate a multi-word passphrase from a bundled word list using cryptographic browser randomness.","checks":["No network dictionary request","Configurable word count and separator","Transparent word-list entropy estimate"],"source":"https://pages.nist.gov/800-63-4/sp800-63b.html","sourceLabel":"NIST SP 800-63B-4","keywords":"passphrase generator, diceware style password, local passphrase maker"},
  {"slug":"secure-token-generator","category":"Identity","title":"Secure Random Token Generator","summary":"Generate random hex or base64url tokens for development and security workflows.","checks":["128 to 512 bits of randomness","Hex or URL-safe base64 output","Cryptographic browser random source"],"source":"https://developer.mozilla.org/en-US/docs/Web/API/Crypto/getRandomValues","sourceLabel":"MDN cryptographic randomness reference","keywords":"secure token generator, random hex generator, base64url token"},
  {"slug":"uuid-generator","category":"Identity","title":"UUID v4 Generator","summary":"Generate one or more standards-shaped UUID version 4 identifiers using browser cryptography.","checks":["Correct version and variant bits","One to twenty identifiers","No analytics or network request"],"source":"https://developer.mozilla.org/en-US/docs/Web/API/Crypto/randomUUID","sourceLabel":"MDN randomUUID reference","keywords":"UUID generator, UUID v4 generator, random UUID online"},
  {"slug":"jwt-decoder","category":"Identity","title":"JWT Decoder and Time Claim Checker","summary":"Decode JWT header and payload locally and interpret exp, nbf and iat time claims without pretending to verify the signature.","checks":["Base64url and JSON structure","Algorithm and token-type signals","Expiry and not-before timestamps"],"source":"https://www.rfc-editor.org/rfc/rfc7519","sourceLabel":"RFC 7519: JSON Web Token","keywords":"JWT decoder, JWT expiry checker, JSON web token parser"},
  {"slug":"totp-generator","category":"Identity","title":"TOTP Code Generator","summary":"Calculate a standards-based time one-time password locally from a Base32 secret.","checks":["SHA-1, SHA-256 and SHA-512 modes","Six or eight digits and configurable period","Current counter and remaining validity time"],"source":"https://www.rfc-editor.org/rfc/rfc6238","sourceLabel":"RFC 6238: TOTP","keywords":"TOTP generator, authenticator code generator, RFC 6238 test"},
  {"slug":"url-privacy-analyzer","category":"Privacy and data","title":"URL Privacy and Safety Analyzer","summary":"Parse a URL and highlight credentials, sensitive query names, insecure schemes and redirect parameters.","checks":["Scheme, origin and embedded credentials","Token, email and tracking parameter names","Punycode and redirect-target indicators"],"source":"https://url.spec.whatwg.org/","sourceLabel":"WHATWG URL Standard","keywords":"URL security checker, URL privacy analyzer, query parameter scanner"},
  {"slug":"base64-tool","category":"Privacy and data","title":"Base64 and Base64url Tool","summary":"Encode or decode UTF-8 text using standard Base64 or URL-safe Base64 without uploading it.","checks":["Unicode-safe conversion","Standard and URL-safe alphabets","Strict decoding error feedback"],"source":"https://developer.mozilla.org/en-US/docs/Glossary/Base64","sourceLabel":"MDN Base64 reference","keywords":"base64 encode decode, base64url decoder, local base64 tool"},
  {"slug":"html-entity-tool","category":"Privacy and data","title":"HTML Entity Encoder and Decoder","summary":"Encode text for HTML text context or decode character references without executing the result.","checks":["Ampersand, angle bracket and quote encoding","DOM-safe text-only output","Clear warning that context-specific encoding still matters"],"source":"https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html","sourceLabel":"OWASP XSS Prevention Cheat Sheet","keywords":"HTML entity encoder, HTML escape tool, entity decoder"},
  {"slug":"email-header-analyzer","category":"Privacy and data","title":"Email Header Analyzer","summary":"Review pasted message headers for authentication-result signals, routing hops and sender-domain mismatches.","checks":["SPF, DKIM and DMARC result tokens","From, Return-Path and Reply-To domains","Received-hop count and date parsing"],"source":"https://www.rfc-editor.org/rfc/rfc8601","sourceLabel":"RFC 8601: Authentication-Results","keywords":"email header analyzer, SPF DKIM DMARC header checker, mail header parser"},
  {"slug":"file-signature-checker","category":"Privacy and data","title":"File Signature Checker","summary":"Compare a local file extension and reported MIME type with common leading-byte signatures.","checks":["PDF, image, archive and executable signatures","Extension and MIME consistency signals","No file upload or content execution"],"source":"https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/MIME_types","sourceLabel":"MDN MIME type guidance","keywords":"file signature checker, magic bytes checker, file type verifier"},
  {"slug":"robots-ai-crawler-analyzer","category":"Discovery","title":"Robots.txt and AI Crawler Analyzer","summary":"Inspect pasted robots.txt rules for search and AI crawler access, keeping search and training controls distinct.","checks":["Wildcard and named crawler groups","OAI-SearchBot, GPTBot and ChatGPT-User","ClaudeBot, PerplexityBot and Google-Extended"],"source":"https://help.openai.com/en/articles/12627856-publishers-and-developers-faq","sourceLabel":"OpenAI publisher crawler guidance","keywords":"AI crawler checker, robots txt analyzer, OAI-SearchBot tester"},
  {"slug":"sitemap-validator","category":"Discovery","title":"XML Sitemap Validator","summary":"Validate a pasted or local XML sitemap for structure, URL quality, duplicates and date formatting.","checks":["urlset and sitemapindex roots","Absolute HTTPS URLs and host consistency","Duplicate locations and lastmod values"],"source":"https://developers.google.com/search/docs/crawling-indexing/sitemaps/build-sitemap","sourceLabel":"Google sitemap guidance","keywords":"sitemap validator, XML sitemap checker, sitemap error finder"},
  {"slug":"security-txt-tool","category":"Discovery","title":"Security.txt Generator and Validator","summary":"Create or review an RFC 9116 security contact file for the well-known security.txt location.","checks":["Contact, Expires and Canonical fields","HTTPS and URI formatting","Expiry horizon and signed-file guidance"],"source":"https://www.rfc-editor.org/rfc/rfc9116","sourceLabel":"RFC 9116: security.txt","keywords":"security txt generator, security.txt validator, RFC 9116 tool"}
]