/tools
Tools
Small, focused web utilities I keep reaching for while writing the blog — so you (and I) can stop pasting URLs into five different validators every time a post ships.
Security
9 tools · readyHeaders, certificates, cookies, DNS. The boring fundamentals you only notice when they fail in production at 2am.
Headers analyzer
Inspect CSP, HSTS, X-Frame-Options, Referrer-Policy, Permissions-Policy and the COOP/COEP/CORP isolation trio. Grade each against current OWASP guidance.
CSP builder
Compose a Content-Security-Policy directive by directive with live validation, then send a synthetic violation to your report endpoint.
CORS preflight
Replay an OPTIONS preflight against a real endpoint and inspect every Access-Control-* response header against the request you describe.
Cookies
Audit every Set-Cookie for SameSite, Secure, HttpOnly, and the newer Partitioned (CHIPS) attribute. Highlight cookies that would break under third-party blocking.
HSTS preload
Check the Strict-Transport-Security header against Chrome’s preload rules — max-age ≥ 1y, includeSubDomains, and the preload directive — before you submit the form.
security.txt
Validate fields against RFC 9116. Confirms Expires is in the future and that the required Contact field is present.
CAA records
List the CA Authorization records for a domain and explain which issuers are permitted (and which are accidentally locked out).
Cache headers
Inspect Cache-Control, ETag, Last-Modified, Vary, Age, and Expires to see exactly how browsers and CDNs will cache — or refuse to cache — a response.
Compression
Negotiate gzip, Brotli, and Zstandard against a URL and confirm which encodings the server actually serves — plus whether it advertises Vary correctly.
SEO & structured data
7 tools · readyRobots, sitemaps, JSON-LD, hreflang, and core meta — the unglamorous fundamentals search depends on.
Meta inspector
Audit title, description, canonical, robots, viewport, charset, and every other meta tag against real length and indexability rules.
JSON-LD validator
Decode every schema.org graph on a page, validate required fields, and preview rich-result eligibility for Article, Product, Breadcrumb, and FAQ.
SERP preview
See how a page renders as a Google result on desktop and mobile, with live pixel-width truncation for the title and description.
Canonical check
Reconcile the canonical link, og:url, HTTP Link header, and redirect target — and flag when they disagree.
hreflang validator
Extract every language alternate and run reciprocity checks — catching missing return links, x-default gaps, and region mismatches.
robots.txt
Fetch and lint a site’s robots.txt, test whether any path is allowed for a given crawler, and generate a fresh file from a form.
sitemap.xml
Validate a sitemap or sitemap index for well-formedness and limits, and generate one from a list of URLs.
RSS & Feeds
3 tools · readyValidate, preview, and convert syndication feeds — RSS 2.0, Atom, RSS 1.0/RDF, and JSON Feed — against each spec.
Feed validator
Fetch a feed and lint it against its spec — required channel/item fields, parseable dates, unique ids, and format-specific rules for RSS, Atom, and JSON Feed.
Feed preview
Render a feed the way a reader would — item titles, dates, authors, and a plain-text summary — so you can see what subscribers get.
Feed converter
Paste or fetch a feed and convert between RSS 2.0 and JSON Feed, with notes on anything the target format cannot represent.
Code & syntax
6 tools · readyPaste-in utilities for the things you copy-paste five times a day — everything runs in your browser, nothing you paste ever leaves the page.
JSON formatter
Format, minify, sort, and validate JSON with exact error positions — and escape/unescape it as a string literal.
Base64 encode/decode
Encode and decode Base64, URL-safe Base64, Base32, and hex — UTF-8 aware, with binary-input detection.
JWT decoder
Decode a JWT’s header and payload locally, with human-readable claim timestamps and expiry checks. The token never leaves your browser.
Diff viewer
Compare two texts side-by-side or unified, with line-level diffs and word-level highlights.
MJML renderer
Write MJML and see the compiled responsive-email HTML rendered live, with the compiler’s own validation errors.
Markdown preview
Write GitHub-flavored Markdown and preview the sanitized rendered result side-by-side.
Social & sharing previews
7 tools · readyInspect, validate, and preview how a URL renders across every major platform — from Open Graph to Apple Smart App Banners.
OG preview
Render how a URL looks on Facebook, LinkedIn, Slack, Discord, iMessage, and more — and lint the meta tags against each platform’s rules.
X Card
Verify a page renders as summary, summary_large_image, app, or player. Check fallbacks when twitter:* is missing and og:* takes over.
LinkedIn post
See how the link unfurls on a feed post and inside a DM. LinkedIn caches aggressively — clear and re-scrape from the panel.
Rich Pin
Validate Article, Product, or Recipe Rich Pins. Confirms required schema.org fields and Pinterest-specific overrides.
Favicons
Check every icon size, Apple touch icon, Android maskable, Safari pinned tab SVG, and Windows tile. Flags missing or wrong-dimension files.
Smart App Banner
Inspect the apple-itunes-app meta tag. Verifies the app-id resolves and that the affiliate / argument parameters parse correctly.
oEmbed
Probe /oembed?url=… for JSON and XML responses. Validates required fields per type (photo, video, link, rich).