Free JWT decoder, CSP evaluator, header and DNS checks

Four free security checks that run in your browser

We run four checks on every engagement: the tokens, the content security policy, the response headers and the domain's DNS records. As of today they are free tools on this site, and the work happens in your browser tab.

Three of the four make no network request at all. The DNS tool has to ask a resolver, so it sends GET requests to one host, cloudflare-dns.com, carrying only the DNS names it looks up. None of them stores anything: no cookies, no localStorage, no analytics. There is no third-party code; each tool is one script written for this site, readable in your developer tools. Whatever you paste is written to the page as text, never as markup, so a hostile token or policy cannot run in it.

Figure 01

Four checks, one tab, one way out

YOUR BROWSER TAB

where the work happens

• JWT DECODER

  no network request

• CSP EVALUATOR

  no network request

• HEADERS CHECK

  never contacts your site

• DNS RECORDS

  names only, to cloudflare-dns.com

JWT decoder: alg none, algorithm confusion and token lifetime

The JWT decoder splits a token, decodes the header and payload, and shows exp, iat and nbf as UTC dates with how long the token has left. It flags alg none in any letter case, an empty signature, HMAC from an issuer that publishes keys, jku, x5u, jwk or x5c headers, a kid with path characters, a missing exp, a lifetime over 24 hours and millisecond timestamps. It never verifies the signature, and says so: that needs the key.

A bad result is alg none, or HS256 on a token from an identity provider that signs with published keys. If your server accepts either, anyone can rewrite the user id or the role. The fix is on the verifier: reject none and pin the algorithm. A token with no exp lives until the signing key changes, so a logout or password reset does nothing to a stolen copy. Keep access tokens to an hour at most and put long sessions on refresh tokens the server can revoke. More in authentication and session checks.

CSP evaluator: what still lets injected script run

The CSP evaluator takes a header line, a meta tag or the bare value, parses each directive into a table, and lists what the policy does well alongside what it leaves open.

The finding that matters most is 'unsafe-inline' in script-src: any HTML injection on the page becomes script execution. Wildcards, https: or data: in script-src, and a whole public CDN allowed for script, let an attacker bring script the policy accepts. A Report-Only policy blocks nothing, and default-src does not cover base-uri or frame-ancestors. Move to nonces with strict-dynamic, add object-src 'none', base-uri and frame-ancestors, and enforce once the reports are quiet. The web app first hour page puts this in the order we test it.

Security headers check: grading a response you fetched yourself

The security headers check never contacts the URL you give it. It builds a curl command for you to run, then grades what you paste back, using the last response in a redirect chain. It checks HSTS, CSP, framing, Referrer-Policy, Permissions-Policy, Cache-Control on pages you mark sensitive, cookie flags and prefixes, version strings and CORS with credentials. Cookie values are dropped while parsing; only names appear.

A bad result is a session cookie without Secure, HttpOnly and SameSite, an account page that a shared cache can hand to the next user because it lacks no-store, or no HSTS. The grade runs A to F, but the findings matter more than the letter. Fix cookies and caching first; web app first hour covers the rest.

DNS and email records: SPF, DMARC, DKIM and CAA

The DNS and email records tool reads SPF, DMARC, DKIM by selector, MX, CAA and address records. Its page names every query: the domain, names built from it such as _dmarc and the DKIM selector, parent names for CAA, and the names the SPF record includes.

A bad result is SPF ending in +all, which lets every server on the internet send as you. SPF allows 10 DNS lookups through every nested include; past ten, receivers return a permanent error and SPF fails for all mail. DMARC at p=none only collects reports; spoofed mail is still delivered. Read the reports, fix real senders, then move to quarantine and reject. A domain that sends no mail still needs v=spf1 -all, DMARC p=reject and a null MX. Without CAA, any public certificate authority may issue for the domain. Email security records reads each record the way we do.

Why the tools are free and run in your browser

We want fewer avoidable breaches, and these are the checks we run on every engagement, so anyone should be able to run them. They run in the browser because nothing you paste should have to leave your machine. A token is a credential until it expires, and a header dump can carry session cookies. Checking them should not mean sending them to us or anyone else.

What to do today

1. 01

   Check every domain you own, including the ones that send no mail. Unprotected domains get spoofed.

2. 02

   Paste the CSP your production site actually sends. Fix 'unsafe-inline' in script-src before anything else.

3. 03

   Grade the headers of your login and account pages with the sensitive box ticked.

4. 04

   Decode a token from a test session, not a live production one.

SOURCES

1. Atarus JWT decoder // what it flags, that it decodes without verifying, and that the token is never sent
2. Atarus CSP evaluator // the policy weaknesses it reports and that the policy is never sent
3. Atarus security headers check // the headers it grades and that it never contacts the URL you enter
4. Atarus DNS and email records // the records it reads and the GET requests to cloudflare-dns.com it makes