• JWT Workbench

  jwt.bntl.ee

  Decode, verify, sign and tamper with JWTs and SD-JWTs. Claim catalogue, algorithm confusion and weak-secret checks. Nothing leaves the page.

• CyberChef

  cyberchef.bntl.ee

  The upstream GCHQ release, v11.4.0. Encoding, encryption, compression, parsing and data analysis, composed as recipes in the browser.

• draw.io

  drawio.bntl.ee

  The upstream jgraph/drawio release, v31.4.6, as static HTML/JS. Draw flowcharts, UML, network and architecture diagrams. Runs offline in the browser — no cloud storage, no server-side save.

• CSP Evaluator

  csp.bntl.ee

  Google's open-source CSP Evaluator core library (v1.1.8) with a small UI. Paste a Content-Security-Policy and it flags XSS bypasses and weaknesses — entirely in the browser, nothing uploaded.

Both tools run entirely in your browser and are served as static files. They are kept on separate hostnames from bntl.ee, which is an intentionally vulnerable test site, so that nothing hosted there can script or read them.