Skip to content
Shortspan

Free tools

Small tools for secrets and access, in your browser.

No account, no upload, nothing saved. Each tool runs entirely on your machine, and each one explains how to do the same thing without it.

Secrets and credentials

Secret generator

Generate random secrets, API keys, JWT signing secrets, passwords, and UUIDs in your browser with the Web Crypto API. Nothing is sent or stored.

Open the tool

Secret scanner

Paste code, logs, or config and find leaked API keys, tokens, private keys, and passwords. The scan runs in your browser; nothing is uploaded.

Open the tool

.env diff and validator

Compare two .env files to find missing, extra, and changed keys, and catch quoting and syntax problems that break dotenv loaders or a shell. Runs in your browser.

Open the tool

JWT decoder

Decode a JSON Web Token to read its header and claims, see expiry in plain time, spot unsigned and long-lived tokens, and verify HMAC signatures - all in your browser.

Open the tool

AWS access key decoder

Paste an AWS access key ID (AKIA, ASIA) or IAM unique ID to see what kind of identifier it is and which AWS account it belongs to. Decoded locally in your browser.

Open the tool

SSH and servers

SSH config generator

Build ~/.ssh/config host entries with users, ports, identity files, and bastion hops (ProxyJump), plus the equivalent one-line ssh commands. Runs in your browser.

Open the tool

SSH key fingerprint

Get the SHA256 and MD5 fingerprints, type, and size of SSH public keys, authorized_keys, and known_hosts lines - matching ssh-keygen -l. Runs in your browser.

Open the tool

sudoers rule generator

Generate a least-privilege /etc/sudoers.d rule that lets one account run specific commands as another - with escaping, shell-escape warnings, and visudo install steps.

Open the tool

authorized_keys restrictions

Restrict an SSH key in authorized_keys: limit source addresses, force a command, set an expiry date, and allow only the forwarding you need - built on the restrict option.

Open the tool

Cloud, Kubernetes, and databases

Connection string builder

Build or parse PostgreSQL and MySQL connection strings: URL, libpq keyword/value, JDBC, PDO, and Laravel .env, with special characters in passwords encoded correctly.

Open the tool

IAM policy explainer

Paste an AWS IAM policy to read each statement in plain English and catch admin-equivalent access, NotAction, wildcard principals, and privilege-escalation actions.

Open the tool

kubeconfig inspector

Paste a kubeconfig to list its contexts, clusters, and users, see how each user authenticates, catch risky settings, and get a redacted copy that is safe to share.

Open the tool

Database user generator

Generate least-privilege CREATE USER and GRANT statements for PostgreSQL and MySQL - read-only, application, and migration roles - plus the statements to remove them.

Open the tool

Cron expression explainer

Explain a cron expression in plain English and list its next run times in UTC or your time zone - including the day-of-month and day-of-week rule most people get wrong.

Open the tool

Process and compliance

Offboarding checklist

Build an offboarding checklist for a departing engineer: what to revoke and which secrets to rotate across GitHub, AWS, Kubernetes, SSH, databases, and more. Print or export it.

Open the tool

Secret rotation planner

Plan when to rotate API keys, database passwords, cloud keys, signing secrets, and certificates. See what is overdue and export a calendar (.ics) or spreadsheet.

Open the tool

Access review template

Generate a user access review spreadsheet and written procedure for your systems and reviewers - the periodic review evidence SOC 2 auditors commonly ask for.

Open the tool