Security Tools
Tools for removing sensitive data from logs before you share them, for checking the security headers and Content-Security-Policy a website sends, and for reading the authentication results and delivery route in raw email headers.
Available security tools
Log Sanitizer
Mask secrets, tokens, and PII in logs before you share them.
JWT Decoder & Inspector
Decode a JWT, inspect its claims and expiry, and review potential security issues locally.
Image Metadata & AI Provenance Cleaner
Inspect image metadata, check supported AI provenance information, and remove hidden metadata locally.
HTTP Security Headers Analyzer
Analyze HTTP response headers for security configuration issues.
CSP Analyzer
Analyze Content Security Policy headers, detect configuration issues, explain directives and sources, and generate safer CSP recommendations.
Email Header Analyzer
Analyze email headers to understand authentication, delivery paths, mail servers, timestamps, and potential security issues.
What security tools cover
Security work for most developers is not exploit research. It is a handful of practical habits: keep secrets and personal data out of places they should not be, and make sure a website tells browsers to apply the protections they already support. The tools in this category cover both.
Logs are the quiet leak. They collect email addresses, IP addresses, session identifiers and sometimes tokens, and then get pasted into support tickets, issue trackers and chat. Response headers are the other half: Content-Security-Policy, Strict-Transport-Security and similar headers cost nothing to send and limit the damage when something else goes wrong, but they are easy to misconfigure or forget.
Email headers are a third place where the evidence lives. When a message looks suspicious or goes missing, its raw headers record which servers handled it and whether SPF, DKIM and DMARC checks passed, and the Email Header Analyzer turns that block of text into something readable.
Common tasks
- Mask emails, tokens, API keys and IP addresses in a log before sharing it.
- Check which security headers a response sends, and which are missing or weak.
- Work out why a Content-Security-Policy blocks a script, or what a directive such as unsafe-inline permits.
- Compare two policies, or draft a stricter starting policy.
- Read the raw headers of an email to see its delivery route and the SPF, DKIM and DMARC results its receiving server recorded.
Who uses these tools
- Developers who paste logs into tickets, issues and chat
- Engineers hardening a website or API before launch
- Site owners who were told to "add security headers" and want to know what that means
- Developers, admins and support staff investigating where an email came from or why it failed authentication
When to use each tool
- Log Sanitizer
- Use it before a log leaves your hands: it finds and masks sensitive values and can show a mapping so you can follow the story without the secrets.
- JWT Decoder & Inspector
- Use it to read a JSON Web Token: it decodes the header and claims, checks expiry against the token's own claims, flags structural and configuration issues, and can verify a signature locally with a key you supply.
- Image Metadata & AI Provenance Cleaner
- Inspect image metadata, check supported AI provenance information, and remove hidden metadata locally.
- HTTP Security Headers Analyzer
- Use it to review a set of response headers: it groups findings by severity and suggests a configuration.
- CSP Analyzer
- Use it when a policy blocks something or looks too permissive: it parses the policy, explains each directive and flags risky sources.
- Email Header Analyzer
- Use it to read raw email headers: it shows SPF, DKIM and DMARC results as reported by the receiving server, the delivery route, timestamps and anomalies.
Related guides
Background reading for the tools above.
What Is Log Sanitization? Why It Matters and How to Do It
Logs capture more than errors - they capture whatever was nearby when something went wrong, including data that should never leave your system.
Updated
How to Remove Sensitive Data from Logs: A Step-by-Step Guide
Before a log leaves your hands - into a ticket, a chat, or an AI prompt - here's exactly what to check for and how to clean it.
Published
HTTP Security Headers Explained: A Practical Developer Guide
A handful of response headers tell the browser how to defend the page they came with. Here's what each one actually does.
Published
Content-Security-Policy (CSP) Explained With Examples
CSP is an allow-list for where your page's resources can load from. Here's how the directives fit together.
Published
How to Fix Common Content-Security-Policy Errors
Read the console message, find the directive, then choose the safest fix: move, nonce, hash, or allow a specific host.
Published
How to Secure HTTP Response Headers: A Practical Checklist
The headers worth setting, safe starting values, how to configure them on Apache and Nginx, and which old ones to leave behind.
Published
How to Read Email Headers
A practical, field-by-field guide to reading raw email headers and knowing which lines to trust.
Published
SPF vs DKIM vs DMARC Explained
Three standards, three different identities. Here is what each one checks and how DMARC combines them.
Published
Planned tools
Not available yet.
- Secret Scanner
- JWT Generator
- Password Generator
- Hash Generator
- SSL Certificate Viewer
- Temporary Email
Frequently asked questions
- Do the security tools upload what I paste?
- No. The Log Sanitizer, HTTP Security Headers Analyzer, CSP Analyzer, Email Header Analyzer and JWT Decoder & Inspector analyse your input in your browser, so it is not sent to DevCraftKit. Even so, avoid pasting live credentials into any web page unless you need to, and rotate a secret that has been exposed.
- Will the Log Sanitizer catch every secret?
- No automated tool can. It recognises common formats such as emails, IP addresses, JWTs and well-known key patterns, but an unusual secret in free text can slip through. Read the result before sharing it.
- Is the headers analyzer a security audit?
- No. It checks the headers you give it against well-known recommendations. A good result does not mean a site is secure, and it cannot see anything that is not in the headers.
- What is the difference between the Headers Analyzer and the CSP Analyzer?
- The Headers Analyzer looks across all security-related headers at a high level. The CSP Analyzer goes deep on one of them, Content-Security-Policy, and explains each directive and source.
- Does the Email Header Analyzer tell me whether an email is safe or a phishing attempt?
- No. It shows what the headers record, such as the delivery route and the SPF, DKIM and DMARC results added by the receiving server, and flags anomalies worth a closer look. Many headers are written by the sender's own system and can be forged, so it is evidence to weigh, not a verdict.
- Does decoding a JWT mean it is valid?
- No. Decoding only reads the token, and anyone can create a token with any contents. The JWT Decoder & Inspector shows a claim-based expiry check and can verify a signature against a key you supply, but even a matching signature does not show the token is trusted, unrevoked or authorized.