Security
Session Cookie Security Checker
Paste a Set-Cookie header and see HttpOnly, Secure, and SameSite checked - each missing flag mapped to the specific attack it enables, not a generic warning.
Paste a Set-Cookie header
HttpOnly
JavaScript cannot read this cookie.
Secure
Can be sent over plain HTTP - readable by anyone on the network path (public wifi, a compromised router).
SameSite=lax
Sent on top-level navigation but not on cross-site subrequests - reasonable default, some CSRF protection.
This is one question. ArchSetu answers it for a whole repository.
Call graph, dead code, blast radius and a health score, in about a minute.
Related tools
All Security tools →CORS Config Generator/ExplainerOrigins, methods, headers to generated CORS headers.Security Risk ScannerPaste a real GitHub repo - hardcoded secrets, unsafe dynamic execution, string-built SQL, insecure transport, and weak cryptography. Sign in required.JWT InspectorDecode a JWT header and payload, check expiry - decode-only, signing key never needed.Bcrypt Cost Factor CalculatorA measured benchmark on your hardware plus a target hash time to the right bcrypt cost factor.AWS IAM Policy GeneratorService, access level, and a resource ARN to a valid, scoped IAM policy JSON.API Key Format IdentifierPaste a key prefix - which service it belongs to, based on documented prefix conventions.
Was this tool helpful?