API security tools
Signature and CORS checks belong with integrations. HMAC Checker and CORS Checker on this hub are the same implementations as /security/hmac-generator and /security/cors-checker.
Timestamp Validator is Replay Tester (window check). Auth token expiry is JWT Claims Inspector. Use Security Headers Analyzer when you have a URL, not a pasted token.
Security Headers Analyzer
Free security headers audit: check HTTPS, HSTS, CSP, CORS for any URL. Get security score and fix recommendations.
/api/security-headers-analyzer
CORS Checker
Test CORS policies for an endpoint. See Access-Control-Allow-Origin and headers. Debug cross-origin requests. Free online.
/security/cors-checker
Signature Validator
Verify HMAC signatures for Stripe, GitHub, Shopify webhooks. Test webhook signing. Free signature checker.
/signature-checker
Timestamp Validator
Check if webhook timestamp is within tolerance (replay protection). Test Stripe/GitHub style timestamps. Free.
/replay-tester
Auth Token Expiry Checker
Check JWT exp, iat, nbf: see if token is valid or expired. Free JWT expiry checker for auth debugging.
/jwt-claims-inspector
HMAC Checker
Compute HMAC-SHA256(secret, message) or verify webhook signature. Stripe, GitHub, Shopify. Free HMAC checker.
/security/hmac-generator
FAQ
- Does HMAC Checker verify Stripe signatures?
- It computes or compares HMAC-SHA256 given a secret and payload. You must use the same signed payload Stripe uses (often a timestamp prefix).
- Is CORS Checker a browser preflight?
- It inspects Access-Control-* headers for a URL. For OPTIONS-only debugging see also CORS Preflight Checker on the validators hub.