All tools
All tools run client-side in your browser unless explicitly marked otherwise. No accounts, no cookies.
Certificates & PKI
Decode, lint and untangle X.509, CSRs, SCEP and chains
Certificate Decoder
Paste or drop a PEM/DER certificate and get the full X.509 breakdown: SANs, EKUs, key usage, thumbprints and expiry — without the certificate leaving your browser.
CSR Decoder & Validator
Decode a PKCS#10 certificate signing request and lint it for the problems that break Intune and EAP-TLS: missing SANs, missing UPN, weak keys.
Intune SCEP Profile Linter
Paste an exported Intune SCEP certificate profile (Graph JSON) and get it checked against the known pitfalls: UPN SAN, key size, EKU, renewal threshold and more.
Certificate Chain Builder
Paste certificates in any order — get them sorted leaf → intermediate → root, missing links identified, and a ready PEM bundle out.
server probeSCEP Endpoint Tester
Probe a SCEP/NDES endpoint's GetCACaps and see whether it advertises the capabilities modern clients need (SHA-256, AES, POST).
Network & auth
DNS records, RADIUS/EAP-TLS, subnets
DMARC / SPF / DKIM Analyzer
Type a domain (or paste a record) and get every DMARC, SPF or DKIM tag explained, misconfigurations flagged, and the SPF 10-lookup budget counted.
EAP-TLS Readiness Checker
A guided checklist wizard for certificate-based Wi-Fi: client cert, trust chains, server cert and profile settings — encoding the failure modes that cost people days.
Azure Subnet Calculator
CIDR calculator that knows Azure's rules: the 5 reserved addresses per subnet, real usable host counts, and subnet splitting.
Private Endpoint DNS Zones
Pick the Azure services you use and get every privatelink DNS zone your private endpoints need — plus the public zones on-prem DNS must forward. The Microsoft Learn table, as a tool.
DMARC Record Generator
Answer a handful of questions and get a correct DMARC TXT record with the exact host name to create — plus warnings about the options that bite: missing rua, strict alignment, pct with p=none.
dig & nslookup Output Explainer
Paste the raw output of dig, nslookup or Resolve-DnsName and get a clean record table with the problems flagged: CNAME conflicts, duplicate SPF records, deprecated types, zero TTLs.
Azure DNS Delegation Checker
Verify a domain is correctly delegated to Azure DNS: compares the NS records the world sees against the four name servers assigned to your zone, and catches mixed, stale or recreated-zone delegations.
server probeDNS Record Lookup
Look up A, AAAA, CNAME, MX, NS, TXT, SOA, SRV or CAA records for any public name — with a clear disclosure: this one queries through our server, because browsers can't speak DNS.
Entra & Graph
Tokens, GUIDs, permissions, sign-in errors
Entra Token Decoder
JWT decoder tuned for Entra ID: resolves tenant and app GUIDs to names, translates wids role IDs, explains every claim and shows expiry at a glance.
Microsoft App GUID Lookup
Look up first-party Microsoft application IDs seen in sign-in logs and token claims — appid → name, instantly.
Graph Permission Finder
Describe what you want to do — get the least-privileged Microsoft Graph permission for it, with the PowerShell to go with it.
Entra Sign-in Error Explainer
Paste a full sign-in error message — the AADSTS code is extracted locally and explained, with causes and fixes.
Intune Assignment Visualizer
Paste exported policy JSON and see every assignment as a readable table — includes, excludes, filters and the conflicts that make policies silently apply to no one.
Cost & scheduling
Save money on compute, understand schedules
Azure VM Savings Calculator
Pick a VM size and paint your weekly on-hours grid — see exactly what start/stop scheduling saves per month and year. Shareable link, no login.
Cron / NCRONTAB Visualizer
Paste a cron or Azure Functions NCRONTAB expression and see the next runs in your timezone, plus a plain-English description.
Data utilities
CSV and file inspection