28 services carry this tag in their source record. Tags come from the provider, not from us — a tag is a claim about what the service does, not proof that it does it well.
JWT decode. Decode a JSON Web Token's header and payload without verifying the signature, and report issued-at, not-before and expiry as dates and whether it has expired. The token is not stored. Do not use the result to...
Get a Firebase ID token for authenticating with the callable APIs
Estimate password strength with Dropbox's zxcvbn: score 0-4, estimated guesses and crack time for online and offline attacks, weak patterns found (dictionary, dates, sequences...) and tips. Evaluated in memory, never sto...
Verify a Sign-In with Ethereum (EIP-4361) login: parses domain, address, chain, nonce and dates, checks the signature and expiry, and optionally the expected domain and nonce. Authenticate users or agents by wallet.
Decode a JWT and verify its signature with the public keys of a JWKS URL (RS256, ES256, EdDSA...) or an HMAC secret, checking expiry, audience and issuer; returns header, claims and the exact reason if invalid. Tokens ar...
Verify an Ethereum signature: a personal_sign (EIP-191) message or EIP-712 typed data. Recovers the signer address and, if you pass one, confirms it matches. Local computation; EIP-1271 contract wallets are not covered.
Verify an Ed25519 Solana signature (Phantom/Solflare signMessage) for a message and public key; signature in base58, base64 or hex. Local computation.
Inspect login and auth surface signals such as forms, reset flows, signup links, and headers for $0.01 USDC. Call when you need this bounded result without an API key or subscription. Returns machine-readable JSON via x4...
A record of auth.<domain>: looks up the auth host under the domain you give (A via Cloudflare DoH) and reports whether it exists, its records and TTL. Quick existence check for common hosts like auth without enumerating...
AAAA record of auth.<domain>: looks up the auth host under the domain you give (AAAA via Cloudflare DoH) and reports whether it exists, its records and TTL. Quick existence check for common hosts like auth without enumer...
CNAME record of auth.<domain>: looks up the auth host under the domain you give (CNAME via Cloudflare DoH) and reports whether it exists, its records and TTL. Quick existence check for common hosts like auth without enum...
TXT record of auth.<domain>: looks up the auth host under the domain you give (TXT via Cloudflare DoH) and reports whether it exists, its records and TTL. Quick existence check for common hosts like auth without enumerat...
Decode a JWT without verification: header (algorithm), payload claims (subject, issuer, expiration), expiry status, and time remaining. (Decoding only - signatures are NOT verified.)
Verify an HS256/384/512 JWT signature against a secret and check expiry. Returns valid + decoded payload. (HMAC algorithms only.)
Resolve authentication requirements across an OpenAPI 3.x or Swagger 2.x document. Returns the catalog of security schemes (`components.securitySchemes` in OpenAPI 3, `securityDefinitions` in Swagger 2) verbatim, the doc...
The current time, or a given time, in one or more IANA time zones, with UTC offset, abbreviation, whether daylight saving time is in effect, and the weekday. Give a local time with from_tz to convert it, handling DST cor...
Decode a JSON Web Token without verifying it: header, algorithm, payload claims, issued-at/expiry times and whether it has expired. Use to debug auth tokens and API sessions.
Check whether a phone number is valid and possible, find its country and type (mobile, fixed line, toll free and others), and format it as E.164, international and national (libphonenumber metadata).
OAuth 2.0 authorization-server metadata (RFC 8414) with OpenID fallback: tries /.well-known/oauth-authorization-server then /.well-known/openid-configuration and returns the issuer, authorization/token/revocation/introsp...
OpenID Connect discovery for an issuer: fetches /.well-known/openid-configuration and summarises issuer, authorization/token/userinfo/jwks/end-session/registration endpoints, supported scopes, response types, grant types...
Does a website use Auth0? Fetches the page (homepage for a bare domain) and matches Auth0's fingerprints in the HTML and response headers, returning yes/no with the evidence snippet and the category (auth). Technographic...
Does a website use Okta? Fetches the page (homepage for a bare domain) and matches Okta's fingerprints in the HTML and response headers, returning yes/no with the evidence snippet and the category (auth). Technographics...
Does a website use Clerk? Fetches the page (homepage for a bare domain) and matches Clerk's fingerprints in the HTML and response headers, returning yes/no with the evidence snippet and the category (auth). Technographic...
Does a website use Firebase Auth? Fetches the page (homepage for a bare domain) and matches Firebase Auth's fingerprints in the HTML and response headers, returning yes/no with the evidence snippet and the category (auth...