# Free cybersecurity tools: choose by task and evidence

> Choose free browser security tools for JWTs, HTTP, OpenAPI, IOCs, CVSS and evidence. Practical workflows and the limitations of local processing.

Published: 2026-11-04  
Canonical: https://rootzero.eu/en/research/browser-cybersecurity-tools/

A useful security tool answers a specific question. Decoding a JWT, comparing HTTP responses and calculating a CVSS score are different tasks. Combining their outputs can document a problem, but does not by itself demonstrate a vulnerability.

The [rootzero toolbox](/en/tools/) provides free utilities that run in your browser. This guide explains which to open and how to interpret their output. They process material you supply; they do not replace observing an application or obtaining permission to test it.

## Choose by input and decision

| Your input | Tool | Useful outcome | What remains to verify |
| --- | --- | --- | --- |
| A JWT | [JWT Inspector](/en/tools/jwt/) | Read claims and inspect structure | The server’s actual validation |
| A login URL | [OAuth Inspector](/en/tools/oauth/) | Examine OAuth and OIDC parameters | Provider configuration and behaviour |
| An API document | [OpenAPI Inspector](/en/tools/openapi/) | Prepare a route inventory | Deployed routes and permissions |
| Two HTTP exchanges | [HTTP Diff](/en/tools/http-diff/) | Compare status, headers and bodies | Account identity and business meaning |
| A CSP | [CSP Analyzer](/en/tools/csp/) | Identify directives to examine | The effective browser policy and page context |
| A log excerpt | [IOC Extractor](/en/tools/ioc/) | Extract and normalise indicators | Their origin and relationship to hostile activity |
| A severity assessment | [CVSS Calculator](/en/tools/cvss/) | Reproduce a vector’s score | Metric assumptions and business priority |
| Evidence to share | [Evidence Sanitizer](/en/tools/evidence-sanitizer/) | Prepare a redacted excerpt | Final review and retained evidential value |

A parser also depends on input quality. A truncated response or an undated log may remain insufficient even when its output is readable.

## Workflow 1: investigate authentication

Start with demonstration data or an authorised excerpt. Identify token format, claims and expiry. Decoding a payload does not establish authenticity. Distinguish reading a token, verifying its signature and observing the application accept it.

For OAuth, examine the authorisation URL and callback next. Retain what the analysis needs, without sharing a live login code or client secret. A useful diagnosis connects an observation to its preconditions. An unusual field alone is insufficient to establish a flaw.

For a broader assessment, prepare accounts, roles and workflows as described in the [SpectrAI methodology](https://spectr-ai.eu/en/methodologie). The [AI pentesting guide](https://spectr-ai.eu/en/pentest-ia) explains its scope and limitations.

## Workflow 2: compare API access

Keep reference requests and responses for each authorised role. Compare headers and bodies in HTTP Diff. A size change may be caused by a date or identifier; identical responses may still require a closer look at context. HTTP status alone cannot settle the question.

In a fictional example, two accounts both receive status 200 for a document. Establish its expected organisation and whether the second account should have access. Retain the account-object-response association. Do not include active session credentials in a public report.

OpenAPI helps organise declared routes; it does not prove that access controls are enforced. Tools make observations comparable, while analysis establishes their impact.

## Workflow 3: prepare an actionable finding

An evidence excerpt should preserve preconditions, the asset, steps and outcome. Redact secrets before sharing a copy. Check that replacements have not destroyed the relationship between request and response. Automated redaction still needs review.

For CVSS, retain the vector and justify its metrics. The [FIRST specification](https://www.first.org/cvss/v4.0/specification-document) describes severity and metric groups. Remediation priority also requires exposure and business context.

The [SpectrAI sample report](https://spectr-ai.eu/en/exemple-de-rapport) illustrates a reporting format. It does not predict findings for a different application.

## What local processing means

Catalogue utilities perform calculations in the browser. Loading the website remains a network request. Copying results, saving files or following external links may move information outside that context through your own actions. Local processing cannot protect a compromised workstation or make confidential data public.

Use demonstration data when explaining a method. MSPs should separate customer material and define what may enter a report. Subscribe to [rootzero RSS feeds](/en/feeds/) for new guides.