Triage suspicious text
Extract IOCs, identify hash formats, and safely defang URLs before sharing notes.
Free Forensic Tools
Extract indicators, inspect hashes, decode forensic IDs, mask sensitive data, and normalize logs with browser-local triage helpers.
Press Enter to view results
Popular workflows
Inspect message and link evidence
Summarize email headers, decode Safe Links, and normalize timeline entries locally.
Prepare safe handoff snippets
Mask sensitive data, inspect hex bytes, and decode ObjectId or Snowflake timestamps.
Common tasks
- Extract URLs, emails, IPs, domains, and hashes from pasted text.
- Defang indicators before sharing reports or tickets.
- Decode Safe Links, ObjectId, and Snowflake timestamp hints locally.
- Mask sensitive fields before copying logs into a handoff.
All tools in this topic
File Type Inspector Inspect magic bytes and common signatures for browser-local file triage File Checksum Generate browser-local SHA-256 checksums for pasted forensic snippets Hash Identifier Identify likely MD5, SHA, NTLM, bcrypt, and other hash formats locally IOC Extractor Extract URLs, domains, IP addresses, hashes, and emails from text locally Email Header Analyzer Summarize email headers, received hops, sender fields, and authentication hints locally URL Defang Refang Defang or refang URLs, domains, and IP indicators for safe sharing Safe Links Decoder Decode Microsoft Safe Links and reveal the original URL locally Snowflake ID Parser Decode timestamp hints from Twitter-style Snowflake IDs locally MongoDB ObjectId Parser Decode MongoDB ObjectId timestamps and raw components locally Sensitive Data Masker Mask emails, cards, tokens, IPs, and common secrets before sharing logs Hex Data Inspector Inspect hex bytes, ASCII previews, and entropy hints for pasted data Log Timeline Normalizer Normalize common log timestamps into an ordered browser-local timeline
Frequently asked questions
Are these evidence-grade forensic tools?
No. They are browser-local triage helpers for snippets, logs, and handoff notes.
Do pasted indicators get uploaded?
No. Supported forensic helpers run locally in your browser.
Can I decode Safe Links locally?
Yes. Safe Links Decoder extracts the original URL parameter locally.
Can I mask data before sharing logs?
Yes. Sensitive Data Masker replaces common emails, cards, IPs, and token patterns.