๐Ÿ›  Tools ๐Ÿ“ฐ News ๐Ÿ“˜ Help โš– Terms
โ† BACK TO DASHBOARD

๐Ÿ“– HELP & DOCS

๐Ÿ” Quick Navigation

Core Features

Network & DNS

System & Linux

Security & IAM

Data, Dev & Scripting

Advanced Forensic Tools

๐Ÿ–ฅ๏ธ Workstation & Privacy โ€” Persistent Browser Workstation

What it is: MYSYSAD has evolved beyond a read-only toolkit into a Persistent Browser Workstation โ€” a fully configurable, stateful dashboard that remembers your preferences, layout, and linked files across sessions. All state is stored exclusively inside your own browser. No account is required, no server receives your data, and no database exists.

Pinning & Starring Tools

Every tool card on the main dashboard has a โ˜… star icon that appears in the top-right corner when you hover over the card. Clicking the star pins the tool to the top of the grid so your most-used tools are always within reach.

Typical pinning workflow:
1. Open the dashboard
2. Hover CIDR Calculator โ†’ click โ˜… โ†’ card moves to ๐Ÿ“Œ PINNED TOOLS
3. Hover JWT Decoder โ†’ click โ˜… โ†’ card moves to ๐Ÿ“Œ PINNED TOOLS
4. Reload the page โ€” both cards are still pinned at the top
5. Use ๐Ÿ“ค Export Pins in the Recent Tools sidebar to save your layout
๐Ÿ’ก Tip: Pin the 4โ€“6 tools you use every day. The grid re-sorts instantly on every pin/unpin โ€” there is no save button, changes are immediate and automatic.

Configuration Portability โ€” Export & Import Pins

Your pinned layout can be exported to a .json file and imported on any other browser or device โ€” or shared with your team so everyone starts with the same workstation layout.

Example mysysad-pins.json:
{
  "mysysad_pins": ["cidr", "jwt", "chmod", "dns", "commands"],
  "exported": "2026-02-25T14:30:00.000Z"
}
๐Ÿ’ก Tip: Export your pins before clearing your browser cache โ€” you'll lose localStorage if you do. Keep a copy of mysysad-pins.json in your dotfiles repo or a shared team folder so anyone can get the standard workstation layout with one click.

Zero-Trust Privacy โ€” Where Your Data Lives

MYSYSAD operates on a strict zero-trust, zero-upload architecture. Understanding this model is important when you use the dashboard with sensitive data such as JWT tokens, certificates, IAM policies, or server logs.

๐Ÿ’ก Tip: If you want to verify this yourself, open browser DevTools โ†’ Network tab, then paste a JWT token or certificate into any tool. You will see zero outbound requests to mysysad.com carrying your data. The only requests are the initial page load assets (HTML, CSS, JS) and any news feed polls you trigger.

๐Ÿ“ฐ News Feeds

What it does: A full-page news aggregator pulling live stories from Reddit, Hacker News, CISA advisories, Krebs on Security, and LWN.net โ€” filtered and sorted for sysadmins. Available at /news.html or via the ๐Ÿ“ฐ News link in the top navigation.

Category Tabs

Eight feed categories, each pulling from different sources:

Story Cards

Toolbar Controls

Right Sidebar

Typical workflow:
1. Open News โ†’ Security tab
2. Drag the score slider to 50+ to filter noise
3. Disable Reddit toggle to focus on CISA / Krebs advisories
4. Click a Trending Tag like "vulnerability" to narrow further
5. Hover a story โ†’ click OPEN or COMMENTS
๐Ÿ’ก Tip: Reddit feeds are fetched directly from Reddit's public JSON API โ€” no account needed. Hacker News uses the Algolia search API filtered to tech/sysadmin keywords with 10+ points. Weekly threads and meta posts (e.g. "Moronic Monday") are automatically filtered out.

๐ŸŒ CIDR Calculator

What it does: Calculates IP address ranges, subnet masks, and network information from CIDR notation.

How to use:

Example:
Input: 10.0.0.0/8
โ†’ Network: 10.0.0.0 | First: 10.0.0.1 | Last: 10.255.255.254
โ†’ Broadcast: 10.255.255.255 | Usable Hosts: 16,777,214
๐Ÿ’ก Tip: Common CIDR blocks: /24 = 256 IPs, /16 = 65,536 IPs, /8 = 16.7M IPs

โฐ Cron Generator

What it does: Generates cron expressions for scheduling tasks on Linux/Unix systems.

How to use:

Examples:
0 2 * * * = Every day at 2:00 AM
*/15 * * * * = Every 15 minutes
0 9 * * 1-5 = Weekdays at 9:00 AM
0 0 1 * * = First day of every month at midnight
๐Ÿ’ก Tip: Use * for "any", */n for "every n", and 1-5 for ranges.

๐Ÿ” JWT Decoder

What it does: Decodes JSON Web Tokens (JWT) to view header and payload information.

How to use:

JWT Format:
eyJhbGc...header.eyJzdWI...payload.SflKxw...signature
๐Ÿ’ก Tip: This tool only DECODES tokens โ€” no validation or signature verification.

๐Ÿ“ Base64 Encoder/Decoder

What it does: Encodes text to Base64 or decodes Base64 back to plain text.

How to use:

Text: "Hello World" โ†’ Base64: SGVsbG8gV29ybGQ=
๐Ÿ’ก Tip: Useful for encoding credentials, debugging API responses, or handling binary data.

๐Ÿ”’ Hash Generator

What it does: Generates cryptographic hashes (MD5, SHA-1, SHA-256) from text input.

How to use:

๐Ÿ’ก Tip: Use for file integrity checks, password verification (compare hashes), or debugging.

๐ŸŽจ Color Converter

What it does: Converts colors between HEX, RGB, and HSL formats.

How to use:

HEX: #FF5733 | RGB: rgb(255, 87, 51) | HSL: hsl(9, 100%, 60%)

๐Ÿ“‹ Regex Tester

What it does: Tests regular expressions against sample text with live match highlighting, capture group extraction, find-and-replace, and one-click Python export.

How to use:

Common patterns:
\d{3}-\d{3}-\d{4} = US phone number
[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,} = email
\b(?:\d{1,3}\.){3}\d{1,3}\b = IPv4 address
#[0-9a-fA-F]{6} = hex color code
Python Export example:
import re
pattern = re.compile(r'\d{3}-\d{3}-\d{4}', re.UNICODE)
for m in pattern.finditer(text):
    print(f"Match: {m.group()!r} at pos {m.start()}โ€“{m.end()}")
๐Ÿ’ก Tip: Use the Python Export tab to instantly convert a tested pattern into production-ready code. Send it to the Scratchpad to build up a library of validated patterns.

๐Ÿ”‘ Chmod Calculator

What it does: Converts Linux file permissions between symbolic notation (rwxr-xr-x) and octal notation (755), and explains what each permission means.

How to use:

Common permission sets:
755 โ†’ rwxr-xr-x (owner full, group/others read+execute) โ€” scripts, binaries
644 โ†’ rw-r--r-- (owner read+write, others read-only) โ€” config files
600 โ†’ rw------- (owner only, private) โ€” SSH keys, secrets
777 โ†’ rwxrwxrwx (everyone full access) โ€” avoid in production
๐Ÿ’ก Tip: SSH private keys should always be chmod 600 or SSH will refuse to use them.

๐Ÿ“„ YAML Validator / Formatter

What it does: Validates YAML syntax, formats/pretty-prints YAML, and converts YAML to JSON.

How to use:

Common YAML pitfalls caught:
โ€ข Tabs instead of spaces (YAML requires spaces)
โ€ข Missing colons after keys
โ€ข Inconsistent indentation levels
โ€ข Unquoted strings with special characters (:, #, &, *)
๐Ÿ’ก Tip: Paste Kubernetes manifests, Docker Compose files, Ansible playbooks, or CI/CD config to validate before deploying.

๐ŸŒ€ Curl Builder

What it does: Generates curl commands from a visual form โ€” choose method, URL, headers, auth, body, and options without memorizing flags.

How to use:

Example output:
curl -X POST https://api.example.com/v1/users \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer eyJhbGci..." \
  -d '{"name":"alice","role":"admin"}'
๐Ÿ’ก Tip: Use this when testing REST APIs, webhooks, or debugging HTTP endpoints. The verbose flag (-v) shows request/response headers which is invaluable for debugging auth issues.

๐Ÿ Scripts Library

What it does: Provides 50+ ready-to-use Python scripts for common sysadmin tasks.

How to use:

Categories:

๐Ÿ’ก Tip: All scripts are production-ready and include error handling. Review before running on production systems.

๐Ÿ Python Sandbox

What it does: Runs real Python entirely in your browser using Pyodide (WebAssembly). No server, no installs, no data leaves your machine. Scripts run in a background Web Worker so even infinite loops can't freeze the page.

How to use:

Test Scripts

Copy and paste these directly into the editor to verify everything is working.

Test 1 โ€” Subnet Matcher

Tests the built-in ipaddress module. Checks a list of IPs against a VPC subnet โ€” a real sysadmin task.

import ipaddress
vpc_subnet = ipaddress.ip_network('10.0.0.0/16')
test_ips = ['10.0.5.12', '192.168.1.5', '10.0.250.99', '172.16.0.1', '10.1.0.5', '8.8.8.8']
print(f"Scanning for IPs inside {vpc_subnet}...\n")
print("-" * 35)
for ip_str in test_ips:
    ip = ipaddress.ip_address(ip_str)
    if ip in vpc_subnet:
        print(f"[MATCH] {ip} belongs to VPC.")
    else:
        print(f"[IGNORED] {ip} is external.")

Test 2 โ€” JSON Alert Cruncher

Tests JSON parsing. Simulates taking a raw API response from a monitoring tool and extracting only the servers that need attention.

import json
raw_data = """
{"fleet": [
  {"hostname": "web-01", "status": "healthy", "uptime_days": 45},
  {"hostname": "db-01", "status": "critical", "uptime_days": 412},
  {"hostname": "cache-01", "status": "healthy", "uptime_days": 12},
  {"hostname": "web-02", "status": "warning", "uptime_days": 85}
]}
"""
data = json.loads(raw_data)
print("=== SERVER ACTION REPORT ===\n")
for server in data['fleet']:
    if server['status'] in ['critical', 'warning']:
        print(f"โš ๏ธ ALERT: {server['hostname']} is {server['status'].upper()}")
        if server['uptime_days'] > 365:
            print(f" -> Note: Hasn't rebooted in over a year ({server['uptime_days']} days).")

Test 3 โ€” Kill Switch Stress Test

Proves the Web Worker isolation works. Run this, watch it loop, then hit โน KILL SCRIPT. Without the Worker this would permanently freeze the browser tab.

import time
print("Starting an infinite loop...")
print("Hit the red KILL SCRIPT button to stop it!")
print("-" * 40)
counter = 1
while True:
    print(f"Loop {counter}: still running...")
    counter += 1
    time.sleep(0.5)
๐Ÿ’ก Tip: Use ๐Ÿ“ UPLOAD FILE to load real log files, then parse them with open('auth.log'). The file is written into Pyodide's virtual filesystem โ€” your actual file never leaves your browser.

๐ŸŒ World Clock & Meeting Planner

What it does: Displays live time across multiple timezones with a suite of scheduling tools โ€” a pinned UTC reference, a time-travel slider for planning windows, weekend warnings, relative offset labels, one-click schedule copying, and full JSON/YAML config export.

How to use:

Pinned UTC & UNIX Epoch

Clicking the UTC row copies:
1741004400  โ† UNIX epoch at time of click

Plan Ahead Slider

๐Ÿ’ก Tip: Use the slider to find a maintenance window that avoids business hours in every timezone your team spans. Drag forward until you find a slot where all zones show late evening or early morning on a weekday.

Relative Offsets

Weekend Warning

Copy Schedule

Copy Schedule output example:
Schedule: UTC 08:30 PM | Dallas 02:30 PM | London 08:30 PM | Tokyo 05:30 AM+1

Import & Export (JSON / YAML)

Exported JSON example:
{ "timezones": ["UTC","America/Chicago","Europe/London","Asia/Tokyo"], "exported": "2026-03-01T10:00:00Z" }

Equivalent YAML export:
timezones:
  - UTC
  - America/Chicago
  - Europe/London
  - Asia/Tokyo
exported: "2026-03-01T10:00:00Z"
๐Ÿ’ก Tip: The World Clock is performance-optimised. When the Plan Ahead slider is active it ticks every second. When you are in Live mode and switch to another browser tab, the clock throttles automatically to once-per-minute updates to save CPU and battery โ€” it resumes full speed when you return to the tab.

๐Ÿ’พ Scratchpad & Local Disk Sync

What it does: The Scratchpad is a persistent notepad inside the right sidebar for pasting logs, IP lists, commands, output from tools, or any temporary notes. It auto-saves to localStorage as you type. The Local Disk Sync feature extends this by linking the Scratchpad directly to a physical .txt file on your hard drive using the browser's File System Access API โ€” so your notes survive even if browser storage is cleared.

Basic Scratchpad Usage

Linking a Local File โ€” Local Disk Sync

Local Disk Sync uses the browser's File System Access API to create a persistent, bi-directional link between the Scratchpad and a physical file on your hard drive. Once linked, every write to the Scratchpad is mirrored to the file in real time.

๐Ÿ’ก Tip: Local Disk Sync requires Chrome 86+, Edge 86+, or Opera 72+. It is not available in Firefox or Safari (File System Access API is not supported in those browsers). The file handle is stored in IndexedDB and restored automatically on next page load โ€” you won't need to re-select the file each session.

๐Ÿ’ป Command Reference

What it does: A searchable library of 200+ Linux/Unix commands with inline flag tooltips, risk ratings, Pipeline Tray for building multi-step one-liners, and recently viewed history.

How to use:

Recently Viewed

Pipeline Tray

Pipeline example โ€” find top memory-consuming processes:
ps aux โž• Pipe โ†’ sort -rk 4 โž• Pipe โ†’ head -20

Result copied from tray:
ps aux | sort -rk 4 | head -20
Flag tooltip example:
Command: rm -rf /tmp/cache
Hover -r โ†’ tooltip: "Recursive โ€” delete directories and their contents"
Hover -f โ†’ tooltip: "Force โ€” no prompts, ignore nonexistent files"
๐Ÿ’ก Tip: Use the Pipeline Tray to build complex one-liners without memorising syntax. Search for each step ("sort", "grep", "awk"), Pipe them in order, then copy the assembled command. Pay attention to red CRITICAL cards โ€” commands like rm -rf, dd, and mkfs are marked because they are irreversible.

๐Ÿ“Š Log Parser

What it does: Parses, filters, and analyses log files from NGINX, Apache, Syslog, Docker/Kubernetes, and JSON structured logs โ€” live in your browser. Generates ready-to-copy grep, awk, and one-liner shell commands based on your active filters.

How to use:

Filter examples:
Status: 5xx โ†’ shows only server errors
IP: 192.168.* โ†’ wildcard match on a subnet
URL: /api/* โ†’ all API endpoint hits
Method: POST โ†’ write requests only
Generated command example:
grep -E ' (5[0-9]{2}) ' access.log | grep '192\.168\.' | grep '/api/'
๐Ÿ’ก Tip: Use โ†’ All to Scratchpad to capture your exact filter + commands as a timestamped audit entry. Useful for incident response documentation.

๐Ÿ” Security Header Tester

What it does: Analyses the HTTP security headers of any URL, assigns a security grade (A+ to F), and generates ready-to-paste NGINX and Apache config snippets to fix any missing headers.

Headers Checked:

How to use:

NGINX remediation output example:
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
add_header Content-Security-Policy "default-src 'self'; ..." always;
add_header X-Content-Type-Options "nosniff" always;
๐Ÿ’ก Tip: Most browsers block cross-origin HEAD requests (CORS). If the test falls back to Recommendation Mode, the tool still generates accurate remediation config โ€” use Browser DevTools โ†’ Network tab to verify the actual response headers live.

โš™๏ธ Systemd Service Generator

What it does: Generates production-ready .service files for Linux systemd with a live preview that updates as you type. Covers all three sections: [Unit], [Service], and [Install].

Quick Templates:

How to use:

Installation steps (auto-generated):
sudo cp webapp.service /etc/systemd/system/webapp.service
sudo systemctl daemon-reload
sudo systemctl enable webapp
sudo systemctl start webapp
sudo systemctl status webapp
๐Ÿ’ก Tip: Use Type=notify with daemons that support sd_notify() โ€” systemd will wait for the ready signal before marking the service as active. Use Type=simple for everything else.

๐ŸŒ DNS Propagation Checker

What it does: Queries 12 global DNS resolvers using DNS-over-HTTPS (DoH) directly from your browser to check whether a DNS record has propagated worldwide. Detects inconsistencies and shows per-server response times.

DNS Servers Queried:

Record Types Supported:

How to use:

Dashboard audit snippet example:
[DNS PROPAGATION AUDIT] โ€” 14 Jul 2025, 09:41
Domain: example.com | Type: A | Status: โœ“ Fully propagated
Checked: 12/12 Successful: 4 Failed: 8 Unique results: 1

โ”€โ”€ CLI Verification โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€
dig @1.1.1.1 example.com A
nslookup -type=A example.com 8.8.8.8
๐Ÿ’ก Tip: Most resolvers block browser-based DoH queries (CORS). Only Cloudflare reliably responds. Failed cards mean CORS is blocking the query โ€” not that your DNS is broken. Use the generated dig / nslookup CLI commands for authoritative checking, or visit WhatsmyDNS.net for server-side verification.

๐Ÿ”‘ Zero-Trust PKI Inspector

What it does: Parses X.509 certificates locally to extract expiration dates, issuers, and Subject Alternative Names (SANs) without uploading private certs to the internet.

How to use:

Example PEM header:
-----BEGIN CERTIFICATE-----
MIIDXTCCAkWgAwIBAgIJALx...
-----END CERTIFICATE-----

Decoded output:
Subject: CN=example.com
Issuer: Let's Encrypt Authority X3
Valid Until: 2026-09-15 โ€” 203 days remaining
SANs: example.com, www.example.com, api.example.com
๐Ÿ’ก Tip: All parsing happens entirely in your browser. Your certificate never leaves your machine โ€” safe to use with internal or wildcard certs. Retrieve a cert from the command line with: openssl s_client -connect host:443 </dev/null 2>/dev/null | openssl x509 -text

๐Ÿ›ก๏ธ AWS IAM & K8s Policy Linter

What it does: Scans JSON (AWS IAM) or YAML (Kubernetes RBAC) policies for dangerous wildcards, overly permissive actions, and privilege escalation vectors.

How to use:

Example โ€” dangerous IAM policy snippet:
{
  "Effect": "Allow",
  "Action": "*",
  "Resource": "*"
}

Linter output:
โš ๏ธ CRITICAL โ€” Line 3: Wildcard Action grants full AWS access
โš ๏ธ CRITICAL โ€” Line 4: Wildcard Resource removes all scope restriction
Example โ€” K8s RBAC privilege escalation:
rules:
  - apiGroups: ["*"]
    resources: ["*"]
    verbs: ["*"]

Linter output:
โš ๏ธ CRITICAL โ€” Wildcard verb on wildcard resource = cluster-admin equivalent
๐Ÿ’ก Tip: Run the linter on every policy before a deployment or PR merge. Pay particular attention to iam:PassRole, sts:AssumeRole, and iam:CreatePolicyVersion โ€” these are the most common privilege escalation vectors.

๐Ÿ”— Connection String Builder

What it does: Generates perfectly formatted database URIs and ready-to-use connection code snippets for PostgreSQL, MongoDB, Redis, and MySQL.

How to use:

PostgreSQL URI example:
postgres://appuser:[email protected]:5432/production

Python (psycopg2):
import psycopg2
conn = psycopg2.connect("postgres://appuser:[email protected]:5432/production")

Node.js (pg):
const { Pool } = require('pg');
const pool = new Pool({ connectionString: 'postgres://appuser:[email protected]:5432/production' });
Redis & MongoDB examples:
Redis URI: redis://:[email protected]:6379/0
MongoDB URI: mongodb://user:[email protected]:27017/mydb?authSource=admin
๐Ÿ’ก Tip: Never hardcode connection strings in source code. Copy the generated URI into an environment variable (DATABASE_URL) and reference it in code. Use .env files locally and secrets managers (AWS Secrets Manager, Vault) in production.

๐Ÿณ Docker Compose Visualizer

What it does: Reads a docker-compose.yml file and generates a clean, interactive vis-network dependency graph of your container architecture โ€” services, ports, volumes, networks, links, and healthcheck status.

How to use:

Parsing capabilities:

๐Ÿ’ก Tip: Use the visualizer before deploying a new Compose stack to spot missing depends_on relationships or orphaned services. Click any service node to inspect its full config without scrolling through YAML.

๐Ÿ—๏ธ Terraform Plan Analyzer

What it does: Parses the raw text output of a terraform plan command into a clean, colour-coded dashboard showing exactly what will be created, modified, or destroyed โ€” so you can review changes safely before running terraform apply.

How to use:

Paste plan output like this:
Terraform will perform the following actions:

  # aws_instance.web will be created
  + resource "aws_instance" "web" {
      + ami = "ami-0c55b159cbfafe1f0"
      + instance_type = "t3.micro"
  }

  # aws_s3_bucket.logs will be destroyed
  - resource "aws_s3_bucket" "logs" { ... }

Analyzer output:
โœ… 1 to create    โš ๏ธ 0 to change    ๐Ÿ”ด 1 to destroy
๐Ÿ’ก Tip: Always run terraform plan -out=tfplan to save the plan, then apply that exact saved plan with terraform apply tfplan โ€” this prevents drift between what you reviewed and what gets applied. The analyzer works on both plain text and -json plan output.

๐Ÿ” SSO / SAML & JWT Autopsy

What it does: Decodes opaque JWT tokens and massive Base64-encoded SAML Responses to extract the critical claims needed for troubleshooting broken SSO logins โ€” all locally, nothing sent to a server.

How to use:

JWT decode example:
Input: eyJhbGciOiJSUzI1NiJ9.eyJzdWIiOiJ1c2VyQGV4YW1wbGUuY29tIi4uLn0.sig

Decoded payload:
{
  "sub": "[email protected]",
  "iss": "https://idp.example.com",
  "aud": "https://app.example.com",
  "exp": 1735689600,
  "iat": 1735686000
}
Expiry: EXPIRED โ€” Wed, 01 Jan 2025 00:00:00 GMT
SAML decode workflow:
1. Capture the SAMLResponse POST parameter from browser DevTools โ†’ Network tab
2. Paste the Base64 value here โ†’ tool URL-decodes then Base64-decodes the XML
3. Extracted fields: NameID, IssueInstant, NotOnOrAfter, all Attributes
๐Ÿ’ก Tip: The most common SSO failure causes are clock skew (token issued before NotBefore or after NotOnOrAfter), mismatched Audience values, and incorrect NameID format. Check these three fields first in any failed SSO login.

โ˜ธ๏ธ Kubernetes Manifest Builder

What it does: Dynamically generates production-ready YAML for Kubernetes Deployments, Services, and Ingress resources so you don't have to write boilerplate from scratch.

How to use:

Example โ€” Deployment + Service output:
apiVersion: apps/v1
kind: Deployment
metadata:
  name: myapp
spec:
  replicas: 3
  selector:
    matchLabels: {app: myapp}
  template:
    spec:
      containers:
      - name: myapp
        image: registry.example.com/myapp:v1.2.3
        ports:
        - containerPort: 8080
๐Ÿ’ก Tip: Set resource requests and limits on every container to prevent noisy-neighbour problems. After generating the base manifest, add resources.requests.cpu, resources.requests.memory, and their limits equivalents before deploying to production.

๐Ÿงน Log Scrubber & Anomaly Finder

What it does: Processes server logs entirely in your browser to redact sensitive PII (IP addresses, emails, tokens) and isolate critical errors โ€” safe to use with production log data.

How to use:

Before scrubbing:
192.168.1.45 - [email protected] [24/Feb/2026] "POST /api/login" 401
10.0.0.12 - - [24/Feb/2026] "GET /dashboard" 200
203.0.113.7 - [email protected] [24/Feb/2026] "DELETE /users/99" 500

After Redact IPs/Emails + Errors Only:
[REDACTED] - [REDACTED] [24/Feb/2026] "POST /api/login" 401
[REDACTED] - [REDACTED] [24/Feb/2026] "DELETE /users/99" 500
๐Ÿ’ก Tip: All processing happens client-side โ€” your logs never leave your browser. This makes it safe to use with production data containing real customer IPs and email addresses. Always scrub before attaching log files to external support tickets or public issue trackers.

๐Ÿงฎ High-Powered Sysadmin Calculator

What it does: A multi-tab calculator designed specifically for infrastructure math, featuring Scratchpad integration on every tab โ€” click โ†’ Scratchpad on any result to instantly export your calculation to the dashboard notepad for documentation or sharing.

Tab 1 โ€” Scientific Calculator

A robust math engine with a full grid of calculator buttons and real-time expression evaluation as you type.

Example expressions:
sqrt(144) โ†’ 12
2^10 โ†’ 1024
sin(ฯ€/6) โ†’ 0.5
log(1000) โ†’ 3
(1024 ร— 1024) รท 8 โ†’ 131072  (bits to bytes)
1 โˆ’ 0.9999 โ†’ 0.0001  (clean, no floating-point noise)

Tab 2 โ€” Programmer Base Converter

Instantly converts between Decimal, Hexadecimal, Binary, and Octal as you type in any field. All four representations stay in sync in real time.

Example โ€” converting decimal 255:
DEC: 255
HEX: FF  (0xFF)
BIN: 11111111  (8 bits)
OCT: 377  (0377)

Example โ€” a 64-bit memory address:
HEX: 7FFEE4B2A000
DEC: 140732009709568
BIN: 11111111111111101110010010110010101000000000000 (47 bits)
๐Ÿ’ก Tip: Use the HEX field when working with MAC addresses, memory addresses, colour codes, or file magic bytes. Use the BIN field to visualise bitmask operations โ€” for example, understanding which permission bits are set in a chmod value.

Tab 3 โ€” Data Transfer Time

Estimates how long a file transfer will take based on file size, link speed, and protocol overhead.

Example โ€” 5 TB backup over a 1 Gbps LAN with 10% overhead:
File Size: 5 TB | Speed: 1 Gbps | Overhead: 10%
Effective Throughput: 112.500 MB/s
Estimated Time: 12h 49m 46s

Example โ€” 100 GB upload over a 100 Mbps WAN with 20% overhead:
File Size: 100 GB | Speed: 100 Mbps | Overhead: 20%
Effective Throughput: 10.000 MB/s
Estimated Time: 2h 50m 40s
๐Ÿ’ก Tip: Always use 20% overhead for WAN estimates โ€” real-world internet transfers rarely achieve more than 80% of the advertised link speed due to TCP slow-start, congestion, and ISP throttling. For local 10GbE network transfers, 10% is usually accurate.

Tab 4 โ€” RAID Capacity

Calculates usable storage capacity, efficiency percentage, and fault tolerance for all five common RAID levels simultaneously.

Example โ€” 8 drives ร— 4 TB each (32 TB raw):
RAID 0: 32.00 TB โ€” 100% efficiency, 0-drive fault tolerance
RAID 1: 16.00 TB โ€” 50% efficiency, 1-drive fault tolerance
RAID 5: 28.00 TB โ€” 87% efficiency, 1-drive fault tolerance
RAID 6: 24.00 TB โ˜… โ€” 75% efficiency, 2-drive fault tolerance
RAID 10: 16.00 TB โ€” 50% efficiency, 1-drive fault tolerance

Example โ€” 3 drives (RAID 6 unavailable):
RAID 6: Requires min 4 drives
RAID 10: Requires min 4 drives
๐Ÿ’ก Tip: For production storage where data integrity matters, RAID 5 is the minimum recommended level โ€” it gives you one drive failure tolerance. RAID 6 is preferred for large arrays (6+ drives) because the statistical probability of a second drive failing during the rebuild of a RAID 5 array increases significantly as drive capacities grow. Never use RAID 0 alone for anything you cannot afford to lose.

Tab 5 โ€” SLA & Uptime

Translates a target SLA percentage into the exact maximum allowed downtime per day, week, month, and year.

SLA comparison table:
99%    โ€” Year: 3d 15h 39m | Month: 7h 18m | Day: 14m 24s
99.9%  โ€” Year: 8h 45m 57s | Month: 43m 50s | Day: 1m 26s
99.99% โ€” Year: 52m 35s | Month: 4m 23s | Day: 8.64 sec
99.999%โ€” Year: 5m 15s | Month: 26.30 sec | Day: 0.86 sec
๐Ÿ’ก Tip: When defining SLAs with customers or management, work backwards from the downtime budget. If your deployment pipeline takes 15 minutes and you deploy twice a week, you are already consuming ~26 hours of downtime per year โ€” which means a 99.7% SLA is the realistic maximum before you even account for unplanned outages. Use this calculator to set achievable targets.

๐Ÿ—บ๏ธ Visual VPC Planner

What it does: An interactive visual designer for planning cloud VPC (Virtual Private Cloud) network topologies. Draw subnets, assign CIDR blocks, and let the tool automatically detect overlapping address spaces before you deploy โ€” preventing the painful IP collision errors that are impossible to fix without re-provisioning.

How to use:

Example subnet layout โ€” multi-AZ 3-tier VPC:
VPC: 10.0.0.0/16 (65,534 usable hosts)

public-1a 10.0.1.0/24 (254 hosts) โ€” Public
public-1b 10.0.2.0/24 (254 hosts) โ€” Public
private-1a 10.0.11.0/24 (254 hosts) โ€” Private
private-1b 10.0.12.0/24 (254 hosts) โ€” Private
db-1a 10.0.21.0/24 (254 hosts) โ€” Database
db-1b 10.0.22.0/24 (254 hosts) โ€” Database

โœ… No collisions detected โ€” all subnets fit within 10.0.0.0/16
Terraform export example (one subnet):
resource "aws_subnet" "public_1a" {
  vpc_id = aws_vpc.main.id
  cidr_block = "10.0.1.0/24"
  availability_zone = "us-east-1a"
  tags = { Name = "public-1a", Type = "public" }
}
๐Ÿ’ก Tip: Always leave at least one contiguous /24 block unused between your public, private, and database tiers. This gives you room to add subnets in the future without re-numbering. For example, use 10.0.1.xโ€“2.x for public, skip 10.0.3.xโ€“10.x, then start private at 10.0.11.x.

๐Ÿš‡ SSH Tunnel Builder

What it does: A visual form-based builder for SSH port forwarding commands. Supports all three tunnelling modes โ€” Local, Remote, and Dynamic (SOCKS5) โ€” and auto-generates both the ready-to-run ssh command and the corresponding ~/.ssh/config block so you can make the tunnel permanent without remembering obscure flags.

Tunnel Modes:

How to use:

Local forward โ€” access a private RDS database on port 5432:
ssh -N -L 5432:db.internal.corp:5432 [email protected]

Equivalent ~/.ssh/config block:
Host rds-tunnel
  HostName bastion.example.com
  User ec2-user
  LocalForward 5432 db.internal.corp:5432
  ServerAliveInterval 60
  ExitOnForwardFailure yes
Dynamic SOCKS5 proxy โ€” browse internal services via bastion:
ssh -N -D 1080 [email protected]

Then configure your browser to use SOCKS5 proxy 127.0.0.1:1080.
๐Ÿ’ก Tip: Add ServerAliveInterval 60 and ServerAliveCountMax 3 to any tunnel config block to prevent idle connections from being dropped by firewalls. Use -f -N together to start the tunnel in the background immediately โ€” combine with autossh in production for auto-reconnecting tunnels.

๐Ÿ›ก๏ธ Command Scanner

What it does: Audits shell commands and scripts for destructive, risky, or irreversible flags before you run them. Paste any command or multi-line shell script and the scanner highlights dangerous patterns with severity ratings โ€” so you can catch rm -rf / style mistakes before they happen.

How to use:

Severity Levels:

Input script:
#!/bin/bash
TARGET=/tmp/old_data
rm -rf $TARGET
curl https://example.com/setup.sh | bash
chmod -R 777 /var/www

Scanner output:
Line 3 โ€” CRITICAL: rm -rf with variable path โ€” risk of recursive deletion if $TARGET is empty or unset.
Line 4 โ€” WARNING: curl | bash executes remote code without inspection. Download and review first.
Line 5 โ€” WARNING: chmod -R 777 makes all files world-writable โ€” significant security exposure.
๐Ÿ’ก Tip: Always quote your variables ("$TARGET" not $TARGET) to prevent word splitting. An unquoted, empty variable in rm -rf $TARGET becomes rm -rf โ€” which deletes the current directory. The scanner flags this pattern specifically.

โšก Data Transformer

What it does: A multi-step data conversion pipeline that chains together encoding and decoding operations in a single pass. Supports Base64, URL encoding, Hex, and JWT decoding โ€” with a visual step-by-step breakdown so you can see exactly what each transformation does to your data.

How to use:

Common Multi-Step Workflows:

Example โ€” decode a double-encoded token:
Input: eyJhbGciOiJSUzI1NiJ9%2e... (URL-encoded JWT)

Step 1 โ€” URL Decode โ†’ eyJhbGciOiJSUzI1NiJ9.eyJzdWIi...
Step 2 โ€” JWT Decode โ†’ { "sub": "[email protected]", "exp": 1741004400 }

Final output: decoded JWT payload ready to inspect.
๐Ÿ’ก Tip: If a step produces an error (e.g., invalid Base64 input), the step card turns red and shows the error message โ€” subsequent steps are skipped. Fix the input or remove the invalid step and the pipeline re-runs automatically.

๐Ÿ“„ Config Generator

What it does: Generates starter configuration file templates for the most common server and development tools โ€” NGINX, Apache, SSH daemon, Docker Compose, and .gitignore โ€” so you don't have to start from a blank file or hunt for documentation.

How to use:

NGINX reverse proxy template output (domain: app.example.com, upstream: localhost:3000):
server {
  listen 80;
  server_name app.example.com;
  location / {
    proxy_pass http://localhost:3000;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
  }
}
๐Ÿ’ก Tip: The SSH config template includes hardened defaults โ€” PermitRootLogin no, PasswordAuthentication no, and AllowUsers with a placeholder. Always review and adjust AllowUsers to list only the specific accounts that need remote access before deploying.

๐Ÿ–ฅ๏ธ SSH Key Generator

What it does: Generates Ed25519 and RSA SSH keypairs entirely in your browser using the Web Crypto API โ€” no private key material is ever sent to any server. Produces the public key in OpenSSH format ready to paste into ~/.ssh/authorized_keys.

How to use:

Generated Ed25519 public key example:
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBv3... user@workstation

Paste into remote server:
echo "ssh-ed25519 AAAAC3Nz..." >> ~/.ssh/authorized_keys
chmod 700 ~/.ssh && chmod 600 ~/.ssh/authorized_keys
๐Ÿ’ก Tip: Prefer Ed25519 over RSA for all new keys โ€” it uses smaller keys (256-bit vs 2048โ€“4096-bit) with stronger security guarantees and faster authentication. RSA 2048 is still acceptable for legacy systems that do not support Ed25519.

๐Ÿ”‘ Password Generator

What it does: Generates cryptographically secure random passwords using window.crypto.getRandomValues() โ€” the same CSPRNG used by security-critical applications. All generation happens in your browser; no password is ever transmitted.

How to use:

Example outputs by profile:
Length 16, all sets: qK#7mP!vXw2@Ln9$ โ€” Very Strong
Length 24, no symbols: f8tKmP3vXw2Ln9dQrJ7cBe5A โ€” Very Strong
Length 12, no ambiguous: xKm#PvXw2@Ln โ€” Strong
๐Ÿ’ก Tip: For service account passwords, use 32+ characters with all character sets enabled. For passwords you'll need to type manually (e.g., BIOS, KVM console), use 16+ characters with no symbols and exclude ambiguous characters to avoid transcription errors.

โš“ Port Reference

What it does: A searchable, filterable database of well-known TCP/UDP port numbers and their associated services โ€” covering IANA registered ports (0โ€“1023), registered ports (1024โ€“49151), and common ephemeral/dynamic ports used by popular software.

How to use:

Common ports quick reference:
22 TCP โ€” SSH | 25 TCP โ€” SMTP | 53 TCP/UDP โ€” DNS
80 TCP โ€” HTTP | 443 TCP โ€” HTTPS | 3306 TCP โ€” MySQL
5432 TCP โ€” PostgreSQL | 6379 TCP โ€” Redis | 27017 TCP โ€” MongoDB
2375 TCP โ€” Docker API (unencrypted) | 2376 TCP โ€” Docker API (TLS)
6443 TCP โ€” Kubernetes API Server | 10250 TCP โ€” Kubelet API
๐Ÿ’ก Tip: Search for a service by name if you can't remember the port number โ€” for example, typing "elastic" returns ports 9200 (HTTP API) and 9300 (cluster transport). Searching for a port number shows all known services that use it, including known malware and trojan ports flagged with a โš ๏ธ badge.

๐Ÿ›ก๏ธ IP Reputation & MAC Lookup

What it does: Two tools in one โ€” check whether an IP address appears in public threat intelligence databases (spam, malware, botnet, Tor exit nodes), and look up the hardware vendor behind any MAC address using the IEEE OUI registry.

IP Reputation Check

MAC Address / OUI Lookup

IP reputation result example:
IP: 185.220.101.45
Risk Score: 87 / 100 โ€” MALICIOUS
Categories: Tor Exit Node, Port Scanner, Brute Force SSH
ASN: AS4242423914 | Country: DE | Last reported: 2 hours ago

MAC OUI lookup example:
MAC: 00:1A:2B:3C:4D:5E
Vendor: Cisco Systems, Inc. | Registered: US
๐Ÿ’ก Tip: Use IP reputation checks during incident response to quickly triage suspicious entries in your auth logs โ€” paste the source IP to confirm whether it belongs to a known threat actor before escalating. MAC OUI lookup is useful when investigating unknown devices on your network; a MAC with no registered vendor often indicates MAC address spoofing.

๐Ÿ• Timestamp Converter

What it does: Converts between UNIX epoch timestamps and human-readable date/time strings, with support for multiple timezones and all common timestamp formats โ€” milliseconds, seconds, ISO 8601, RFC 2822, and more.

How to use:

Example conversion โ€” epoch 1741004400:
UNIX (s): 1741004400
UNIX (ms): 1741004400000
UTC: Sat, 01 Mar 2026 09:00:00 GMT
ISO 8601: 2026-03-01T09:00:00.000Z
New York: Sat Mar 01 2026 04:00:00 EST
Tokyo: Sat Mar 01 2026 18:00:00 JST
๐Ÿ’ก Tip: When comparing timestamps from logs and API responses, always check whether the value is in seconds or milliseconds โ€” confusing the two off by 1000ร— is a very common bug. A valid seconds-based epoch for 2026 is a 10-digit number (~1.74 billion). A 13-digit number (~1.74 trillion) is milliseconds.

๐Ÿ“‘ Diff Checker

What it does: Side-by-side and inline text comparison with line-level and character-level diff highlighting. Useful for comparing config file versions, spotting changes in Terraform plans, reviewing script edits, or checking what changed between two API responses.

How to use:

Example โ€” comparing two NGINX config versions:
Left (original): worker_processes 1;
Right (modified): worker_processes auto;

Diff output (unified):
- worker_processes 1;
+ worker_processes auto;

Lines removed: 1   Lines added: 1   Lines changed: 1
๐Ÿ’ก Tip: Use Ignore Whitespace when comparing YAML files that have been re-indented โ€” otherwise indentation changes flood the diff and obscure actual content changes. For Terraform plan comparisons, the Unified view with line numbers is easiest to read when sharing with a team for review.

๐Ÿš€ DriftScope Config Intelligence

What it does: Performs semantic, structural diffing of JSON and YAML infrastructure configs โ€” Kubernetes Deployments, Terraform state files, AWS CloudFormation templates, and any other nested config โ€” entirely in the browser. It compares a Baseline (your source of truth, from Git or IaC) against a Target (the live, running state) and surfaces every meaningful difference without false positives from volatile fields.

How to use:

Example โ€” Kubernetes Deployment drift detected:
Mismatch: spec.replicas โ€” Expected: 3 | Actual: 1 (scale-down not in IaC)
Mismatch: spec.template.spec.containers[name=api-gateway].image โ€” Expected: :2.4.1 | Actual: :2.5.0-hotfix
Mismatch: resources.limits.cpu โ€” Expected: "500m" | Actual: "2000m"
Addition: metadata.labels.manual-debug โ†’ "true" (not in Baseline โ€” rogue label)
Addition: env[name=DEBUG_MODE].value โ†’ "true" (debug mode left on in production)
๐Ÿ’ก Tip: DriftScope automatically ignores volatile Kubernetes fields (uid, resourceVersion, creationTimestamp, generation, managedFields) that change on every apply and carry no semantic meaning. This eliminates the noise that plagues text-based diff tools. For Terraform, compare terraform show -json output against your .tfstate file to surface resource attribute drift without running a full terraform plan.

๐Ÿ•ต๏ธ SELinux & AppArmor Audit Translator

What it does: Translates cryptic type=AVC SELinux denial messages and AppArmor DENIED log entries into plain English. It identifies the exact process, target resource, and denied permission, then generates three surgical CLI remediation paths โ€” so you can fix the root cause instead of reaching for setenforce 0.

How to use:

Example SELinux input:
type=AVC msg=audit(1699042800.123:4521): avc: denied { read open } for pid=1234 comm="nginx" name="secret.conf" scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:shadow_t:s0 tclass=file permissive=0

Plain English output: "nginx (PID 1234, running as httpd_t โ€” Web Server) attempted to read open the file secret.conf, which is labeled shadow_t (/etc/shadow password hash) โ€” DENIED."

Fix (Path 1): semanage fcontext -a -t httpd_sys_content_t "/etc/secret.conf"
restorecon -Rv /etc/secret.conf
๐Ÿ’ก Tip: Always start with Path 1 (context relabeling) โ€” it's the most precise fix. Only use Path 3 (custom policy module) when the file's label is genuinely correct and the service legitimately needs the access. Avoid generating broad policy modules from audit2allow -a without reviewing the output; it can silently whitelist dangerous access patterns alongside the one you intend to fix.

๐Ÿšท Linux Permission & Path Traversal Simulator

What it does: Diagnoses 403 Forbidden and Permission Denied errors by visually simulating how the Linux kernel evaluates file permissions as it walks down a directory tree. It pinpoints exactly which directory in the path is blocking access and explains the Unix permission model that causes it.

How to use:

Example โ€” www-data cannot read /var/www/html/index.html:
/ โ€” owner: root, perms: 755 โ†’ โœ“ Execute allowed (other: r-x)
/var โ€” owner: root, perms: 755 โ†’ โœ“ Execute allowed
/var/www โ€” owner: root, group: root, perms: 750 โ†’ โœ• BLOCKED
Reason: www-data is not owner (root), is not in group (root), and other has no execute bit.
Fix: chmod o+x /var/www or chown -R root:www-data /var/www && chmod 750 /var/www
๐Ÿ’ก Tip: The most common cause of 403 errors is a missing execute (+x) bit on a parent directory โ€” not on the file itself. A web server process needs +x on every directory in the path just to traverse it, even if the file itself is world-readable. Run namei -l /path/to/file on the server to see a real-world permission trace identical to what this simulator shows.

๐Ÿ”€ NGINX Route & Proxy Pass Simulator

What it does: Mathematically resolves which NGINX location block wins a given request URI, following the exact NGINX priority algorithm. It also simulates the proxy_pass trailing slash URI mutation rule โ€” showing exactly what URL reaches your upstream backend.

NGINX Location Priority (implemented strictly):

How to use:

proxy_pass URI mutation rule โ€” the classic trailing slash gotcha:
location /api/ { proxy_pass http://backend; }
Request: /api/users โ†’ Upstream: http://backend/api/users (no URI in proxy_pass = pass unchanged)

location /api/ { proxy_pass http://backend/; }
Request: /api/users โ†’ Strips /api/ prefix โ†’ Upstream: http://backend/users

location /api/ { proxy_pass http://backend/service/; }
Request: /api/users โ†’ Strips /api/ โ†’ Appends to /service/ โ†’ Upstream: http://backend/service/users
๐Ÿ’ก Tip: Regex location blocks (~ / ~*) cannot use URI substitution in proxy_pass โ€” the full original request URI is always forwarded regardless of whether you add a trailing slash. Also remember that a single trailing slash difference in proxy_pass completely changes the upstream URL โ€” this is the #1 source of mysterious 404s when first configuring a reverse proxy.

๐Ÿงฑ Firewall Rule Builder

What it does: Visually generates safe, exact CLI firewall commands for iptables, UFW, and firewalld simultaneously from a single form โ€” eliminating the need to remember three different syntax dialects. Includes an SSH Safeguard to prevent accidental server lockouts.

How to use:

Example โ€” Allow HTTPS from a specific CIDR:
Action: Allow | Protocol: TCP | Port: 443 | Source: 10.0.0.0/8

iptables: iptables -A INPUT -p tcp --dport 443 -s 10.0.0.0/8 -j ACCEPT
UFW: ufw allow from 10.0.0.0/8 to any port 443 proto tcp
firewalld: firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="10.0.0.0/8" port protocol="tcp" port="443" accept'
firewall-cmd --reload
๐Ÿ’ก Tip: Always enable the SSH Safeguard before generating any rule that modifies inbound traffic broadly. A single misplaced DROP ALL rule without a preceding SSH allow will lock you out of the server. The safeguard adds the allow rule at the correct position in the chain. For iptables, always use -I (insert at position) rather than -A (append) for critical allow rules, since rules are evaluated top-to-bottom.

โœ‰๏ธ Email DNS Generator (SPF / DKIM / DMARC)

What it does: Generates perfectly formatted DNS TXT records for SPF, DKIM, and DMARC โ€” the three email authentication standards that prevent spoofing, ensure deliverability, and protect your domain's reputation. All three records are required for modern email compliance (Google, Microsoft 365 bulk mail requirements).

How to use:

Tab 1 โ€” SPF (Sender Policy Framework)

Tab 2 โ€” DKIM (DomainKeys Identified Mail)

Tab 3 โ€” DMARC

Complete example โ€” Google Workspace + SendGrid:
SPF: Host: @ | Value: v=spf1 mx include:_spf.google.com include:sendgrid.net ~all
DKIM: Host: google._domainkey.example.com | Value: v=DKIM1; k=rsa; p=MIIBIjAN...
DMARC: Host: _dmarc.example.com | Value: v=DMARC1; p=quarantine; rua=mailto:[email protected]; pct=100;
๐Ÿ’ก Tip: Always start DMARC with p=none and a rua= reporting address. Monitor the daily XML aggregate reports for 2โ€“4 weeks to confirm all legitimate mail streams are passing SPF and DKIM before moving to p=quarantine or p=reject. Moving directly to reject without monitoring first is one of the most common causes of broken email delivery after a domain migration.

๐Ÿ” OpenSSL CSR & Key Builder

What it does: Generates the exact OpenSSL CLI commands to create RSA/ECDSA private keys and Certificate Signing Requests (CSR), including complex Subject Alternative Names (SANs) injected safely via a temporary OpenSSL config file. No more guessing the -subj syntax or searching for how to add SANs on the command line.

How to use:

Example โ€” RSA 4096 CSR with wildcard SANs:
CN: example.com | SANs: example.com, *.example.com, api.example.com

cat > /tmp/san.cnf << 'EOF'
[req]
distinguished_name = req_distinguished_name
req_extensions = v3_req
[req_distinguished_name]
[v3_req]
subjectAltName = DNS:example.com,DNS:*.example.com,DNS:api.example.com
EOF
openssl genrsa -out example.com.key 4096
openssl req -new -key example.com.key -out example.com.csr \
-subj "/C=US/ST=California/L=San Francisco/O=Example Corp/CN=example.com" \
-config /tmp/san.cnf
rm /tmp/san.cnf
๐Ÿ’ก Tip: Always include the bare domain (example.com) as a SAN in addition to www.example.com โ€” many modern browsers no longer rely on the Common Name field and only check the SAN list. For new certificates, prefer ECDSA P-256 over RSA 2048 โ€” it provides equivalent security with a significantly smaller key size, faster TLS handshakes, and is supported by all modern clients and CAs.

๐Ÿ” jq Playground

What it does: Lets you test jq JSON query filters live in your browser โ€” paste a JSON payload, type a jq filter expression, and see the output instantly. Also generates the equivalent copy-paste jq shell command for use in your bash scripts and pipelines.

How to use:

Common jq filter patterns:
.items[].metadata.name โ€” Extract all pod names from kubectl JSON output
.[] | select(.status == "running") | .name โ€” Filter array by field value
. | keys โ€” List all top-level keys of an object
.data | to_entries[] | "\(.key)=\(.value)" โ€” Convert a map to KEY=VALUE pairs
[.items[] | {name: .metadata.name, image: .spec.containers[0].image}] โ€” Reshape into a new array
.. | numbers โ€” Recursively find all numeric values

Equivalent CLI command generated:
cat response.json | jq -r '.items[].metadata.name'
๐Ÿ’ก Tip: Use jq 'keys' as your first filter when exploring an unknown JSON structure โ€” it lists all top-level keys so you can orient yourself before drilling down. For deeply nested data, use .. | .fieldname? // empty to recursively search for a field anywhere in the document without knowing its exact path. The -r (raw) flag is almost always what you want when feeding jq output to other shell commands like xargs, grep, or variable assignment.

๐Ÿ’ก General Tips

Dark Mode

Click the ๐ŸŒ™/๐ŸŒž button in the top-right corner to toggle between dark and light themes. Your preference is saved automatically and synced across all pages.

Keyboard Shortcuts

Browser Compatibility

Works best in Chrome 80+, Firefox 75+, Safari 13+, Edge 80+. The Local Disk Sync feature (File System Access API) requires Chrome 86+, Edge 86+, or Opera 72+ โ€” it is not available in Firefox or Safari.

Privacy

Data Persistence

Settings (dark mode, world clock, scratchpad, pinned tools) are saved to localStorage. They clear if you clear browser cache, use incognito mode, or switch browsers/devices. Use the World Clock export feature to preserve your timezone list. Use the ๐Ÿ“ค Export Pinned button to preserve your workstation layout as a mysysad-pins.json file. Use ๐Ÿ”— Link Local File to keep Scratchpad content on disk independently of browser storage.

โšก Advanced Forensic Workstation Tools

Log Analyzer & Scrubber

A multi-gigabyte log analysis engine. Features visual histograms, frequency ranking for IPs/URLs, and automatic PII scrubbing (redacting IPs, emails, and tokens) before exporting sanitized logs.

Dangerous Command Scanner

Audits shell scripts and one-liners against 135+ forensic patterns. Detects obfuscated reverse shells, destructive cloud commands, and privilege escalation risks locally.

SSH Tunnel Builder

A visual architect for SSH configurations. Supports ProxyJump (Bastion) chains, Local/Remote port forwarding, and Dynamic SOCKS5 proxies with a live visual connection map.

Zero-Trust Policy Linter

Audits AWS IAM JSON and Kubernetes RBAC YAML. Identifies wildcard permissions, "PassRole" escalation risks, and secret-reading privileges without data leaving your browser.

OOM Autopsy

Parses Linux kernel dmesg logs to profile Out-Of-Memory events. Identifies the "victim" process and "offender" processes based on memory usage and OOM scores.

NGINX Simulator

Tests NGINX location block routing logic and proxy_pass trailing slash behavior. Visually determines which location block "wins" for a given URI.

Line Patcher Console

A forensic patching engine for HTML and Config files. Implements a resilient context-matching system to apply surgical updates to large codebases safely.

๐Ÿ–ผ๏ธ WebRSW Pro โ€” Image Operations Console

What it does: A browser-based forensic image editor for sysadmins and security professionals. Redact credentials from screenshots, annotate infrastructure diagrams, add audit stamps, and export clean images โ€” all without any data leaving your browser.

Core capabilities:

Keyboard shortcuts:

๐Ÿ’ก Tip: Use the eraser tool to scrub credentials from terminal screenshots before sharing them in incident reports. The layer system means you can always hide your annotations layer to see the original image underneath.

๐Ÿ—บ๏ธ NetBuilder Pro โ€” Visual Network Topology Architect

What it does: A full-featured visual network design tool. Create servers, routers, firewalls, switches, and cloud nodes on an infinite canvas, connect them with links, assign IP addresses and subnets, simulate packet routing, and export the result as PNG, SVG, or JSON.

Core capabilities:

๐Ÿ’ก Tip: After designing your topology, use the VLSM calculator to assign subnets, then run a packet simulation between two endpoints to verify routing before implementing in production. Export as SVG for editable diagrams in Visio or Figma.

๐Ÿ—‚๏ธ Photo Organizer

What it does: A full-featured browser-based photo and video management tool. Open any folder on your computer, tag and categorize photos, star-rate them, find duplicates, batch rename, and move files into category subfolders โ€” all using the File System Access API with zero uploads.

Getting started:

Tagging & categorization:

Filtering & sorting:

Advanced features:

Keyboard shortcuts (grid):

Keyboard shortcuts (lightbox):

๐Ÿ’ก Tip: For maximum speed, enable Auto-advance in the lightbox, set your filter to "Untagged", and press number keys (1โ€“9) to fly through hundreds of photos. The tool remembers your tags in localStorage even if you close the browser โ€” re-open the same folder to continue where you left off. Use Export State for backup.

โ“ Still Need Help?

If you encounter issues or have questions not covered here:

โ† BACK TO DASHBOARD
Share MySysAd

โš ๏ธ IMPORTANT DISCLAIMER: The tools and scripts on this site are provided "AS IS" for educational purposes.

Review destructive commands before executing. By using this site, you assume all risk and agree to our Full Terms of Service.