About LocalSecTools
Utilities for people who handle data they are not allowed to paste into someone else’s server.
The problem we set out to fix
Security analysts, system administrators and cloud engineers reach for small web utilities dozens of times a day: decode this token, explain this cron line, split this subnet, convert this policy. Most of those sites send what you paste to their servers. That data often includes bearer tokens from production, internal IP plans, IAM policies, phishing samples and customer log lines. Once it is in someone else’s request logs, you no longer control it.
How LocalSecTools works
Every page on this site is pre-rendered at build time, and there are no accounts. The only server endpoint is the optional feedback and contact form, which receives just the message you type. The 10 tools are written against standard browser APIs: bitwise arithmetic for subnets and permissions, TextDecoder and DecompressionStream for decoding, crypto.subtle for JWT signatures, and regular expressions for indicator extraction. Open your browser’s developer tools while you use any of them: your input never triggers a network request.
Because nothing depends on a backend, the tools keep working when you go offline after the first visit. That makes them usable on jump hosts, in isolated incident-response networks and on air-gapped analysis machines.
Built against the specifications
Each tool is implemented from the relevant specification: RFC 4632 for CIDR, RFC 7519 for JWT, RFC 7208 and RFC 7489 for SPF and DMARC, and FIRST’s CVSS v3.1 and v4.0 documents. The reference documentation on every page explains the reasoning behind each result rather than just printing it.
Who builds LocalSecTools
LocalSecTools is created and maintained by Asad Ali, an IT Support Engineer and SOC analyst with a Computer Science degree from UET Lahore. He holds the Microsoft SC-200 Security Operations Analyst and ISC2 Certified in Cybersecurity (CC) certifications, and he writes the site’s engineering guides from day-to-day work on service desks and in security operations. His official website is asadali.tech.
How the site is funded
The site may show advertising through Google AdSense. Ads load from Google, but they never receive the content you type into a tool: tool input is held only in your browser’s memory. See the privacy policy for details, or contact us with feedback and tool requests.