Free tools for shipping backends safely
Small, sharp tools for developers shipping production backends with Claude Code, Cursor, and agentic AI. No account required. Each tool processes its working input on your device; pages may send anonymous visit telemetry, and optional forms send only what you submit.
Measure how trapped you are, what it costs to leave, and how to get out.
Cloud lock-in checker
Paste your package.json and config → see how locked in you are to Vercel, Cloudflare, AWS — line by line — and what it takes to leave.
Check your lock-in →Cloud exit-cost calculator
The real egress bill to move your data off AWS, GCP, Vercel or Azure — and which providers charge $0 to leave.
Price your exit →Bill-shock predictor
Model your usage-based PaaS bill, find the uncapped axis that could spike it, and see a traffic-5× projection.
Predict your bill →Migration scaffold generator
Paste your stack → a portable Dockerfile, docker-compose, and a migration runbook to move onto a box you own.
Generate your exit →Self-hosting cost estimator
What your app costs on a box you own vs your current bill — real VPS and bare-metal pricing, with the savings.
Size your savings →The day-2 operations a managed platform did for you, generated and ready.
Deploy to your own server
A GitHub Actions workflow that ships your app to a box you own over SSH — systemd, Docker Compose, or build-and-push — with the secrets and setup.
Generate the deploy →systemd unit analyzer
Paste a .service unit → runs as root, no sandboxing, no restart policy, each with the directive to add.
Analyze the unit →systemd service generator
A hardened systemd unit that restarts your app on crash and reboot, runs it non-root, and sandboxes it.
Keep it running →DNS records for self-hosting
The exact A, AAAA, www, CAA, and SPF records to point your domain at a server you own — with TTL guidance and a dig check.
Point your domain →Reverse proxy + HTTPS
Put your app behind automatic HTTPS — Caddy or nginx + certbot — with security headers and websockets.
Generate the proxy →Backup script generator
Dump, compress, push offsite, prune — on a schedule — plus the restore command most setups never write.
Generate backups →Healthcheck generator
Correct liveness (/healthz) and readiness (/readyz) endpoints for Express, Fastify, Flask, FastAPI, or Go — with the database check.
Generate endpoints →Kubernetes probe generator
Generate correct liveness, readiness, and startup probe YAML — the startup grace that stops CrashLoopBackOff from a misconfigured liveness probe.
Generate probes →Uptime monitor generator
A self-hosted monitor that watches your service and alerts Slack, Discord, or any webhook after N failures — plus a recovery notice and the systemd timer.
Watch your service →Incident postmortem template
Generate a complete blameless postmortem in Markdown — summary, timeline, root cause, and tracked action items.
Write the postmortem →RPO / RTO calculator
If your database died now, how much data would you lose and how long would you be down? Find out.
Find your exposure →Crontab → systemd timer
Paste a cron line, get a supervised systemd service + timer with the OnCalendar schedule — logged in the journal, with catch-up.
Convert the cron →Log rotation estimator
When will your logs fill the disk — and a logrotate config to cap them for good.
Estimate the fill →#.gitignore generator
Generate a .gitignore for Node, Python, Go, Rust, or Java — keeps secrets, .env, dependencies, and build junk out of version control.
Generate it →#.dockerignore generator
Generate a .dockerignore for Node, Python, Go, Rust, or Java — keeps secrets, .env, .git, and build junk out of your image.
Generate it →Kubernetes manifest auditor
Paste a Deployment or Pod YAML → privileged, hostPath, runAsRoot, missing limits, :latest, and dangerous capabilities, each with the fix.
Audit your manifest →Docker Compose auditor
Paste docker-compose.yml → exposed DB ports, hardcoded secrets, missing restarts, :latest images, and the fix.
Audit your compose →Close the doors on a server you own — in a copy-paste.
nginx config checker
Paste your nginx config → weak TLS, missing security headers, version disclosure, no rate limiting, directory listing, each with the fix.
Check your config →nginx rate limit generator
Cap abuse, brute force, and runaway clients with nginx limit_req — burst handling, a 429 response, and a strict login limiter.
Rate-limit it →UFW firewall generator
Lock down your server: deny incoming by default, allow only what you serve, rate-limit SSH.
Lock it down →CIDR / subnet calculator
Enter an IPv4 block like 10.0.0.0/24 → network, broadcast, usable host range, host count, netmask, and wildcard mask.
Calculate a subnet →fail2ban config generator
Auto-ban IPs that brute-force your SSH or web auth — ban time, retries, and a whitelist for your own IP, plus install commands.
Ban the bots →SSH hardening generator
A hardened sshd_config — key-only auth, no root login, limited attempts — with safe apply commands.
Harden SSH →chmod calculator
Tick read/write/execute for owner, group, other → the octal (755) and symbolic (rwxr-xr-x) permissions, plus the chmod command.
Calculate permissions →PKCE generator
Generate a code_verifier and matching S256 code_challenge for an OAuth 2.0 authorization-code flow — correct length, base64url, SHA-256.
Generate PKCE →Security headers checker
Paste your response headers → an A–F grade and the exact headers to add (HSTS, CSP, X-Frame).
Grade your headers →Secrets scanner
Paste code or a .env and instantly find exposed secrets — AWS, Stripe, GitHub, keys. Nothing uploaded.
Scan for secrets →Let agents touch production without letting them detonate it.
Command risk checker
Paste a command → its blast radius, whether it’s reversible, and why. The guard’s classifier, free.
Check a command →Webhook signature verifier
Verify or generate an HMAC-SHA256 webhook signature — GitHub, Stripe-style, or generic — so forged events can’t fool your app.
Verify a webhook →AI agent guard config
Wire a human-approval gate into Claude Code, Cursor, or Windsurf so agents can’t run destructive commands unsupervised.
Gate your agent →AI-agent blast-radius checker
Paste an agent’s IAM policy, tool list, or config → exactly what it can delete, exfiltrate, spend, or execute.
Map the blast radius →Sharp answers to the everyday backend problems.
Production-ready checker
Paste a Dockerfile, compose, or .env → an instant 0–100 readiness score with the one-line fix for each issue.
Check your deploy →DATABASE_URL builder & parser
Build a Postgres, MySQL, Mongo, or Redis connection string from its parts — or paste one to decode it. URL-encoding handled both ways.
Build the URL →Deploy error decoder
Paste a deploy or runtime error — EADDRINUSE, CrashLoopBackOff, 502, OOMKilled — and get the fix.
Decode the error →CORS config generator
Generate correct CORS for Express, nginx, or Caddy — origins, methods, credentials, and preflight — without the wildcard-plus-credentials trap.
Fix CORS →Cache-Control builder
Build a correct Cache-Control header from plain options — with a plain-English explanation of what it tells browsers and CDNs to do.
Build the header →Basic auth header
Turn a username and password into an Authorization: Basic header and the matching curl command — or decode one back.
Generate the header →Downtime cost calculator
Turn your revenue into the real cost of every minute, hour, and incident of downtime.
Price your downtime →Capacity / concurrency calculator
Peak req/s + response time → the concurrency you need (Little’s Law), the workers and instances to provision, and safe headroom.
Size your backend →Connection pool sizer
Size your DB pool so you never hit the too-many-connections error — max_connections vs instances × pool + reserved, with the deploy-overlap spike.
Size your pool →Latency percentile calculator
Paste response times → p50, p90, p95, p99, min, max, mean, and standard deviation — the percentiles that describe latency.
Compute percentiles →Backoff / retry calculator
Set base delay, multiplier, retries, and cap → the exact backoff schedule, per-attempt wait, and total time before giving up.
Plan retries →Load average interpreter
Paste load average + core count → per-core load, headroom-vs-overloaded verdict, and the 1/5/15-minute trend.
Interpret load average →Uptime SLA calculator
How much downtime 99.9%, 99.99%, or any target actually allows — with a live error-budget tracker.
Do the SLA math →JSON ↔ .env converter
Convert a JSON config object to a .env file or back — quotes, comments, and nested values handled. Nothing uploaded.
Convert config →Cron expression explainer
Paste a cron schedule → plain English, field by field, plus the next run times.
Decode the cron →JWT generator (HS256)
Create and sign a JSON Web Token with HS256 — set the claims, secret, and expiry. Pairs with the JWT inspector to decode.
Generate a JWT →JWT inspector
Decode a JWT’s claims and flag security risks — alg:none, weak algorithms, missing expiry.
Inspect a JWT →Fast, functional dev tools - encode, convert, generate, inspect.
Epoch / timestamp converter
Convert a Unix timestamp to UTC, local, ISO 8601, and relative time, or back — auto-detecting seconds vs milliseconds.
Convert a timestamp →Timezone converter
Convert a date and time across zones at once — UTC, US, Europe, Asia — with daylight saving handled correctly for the date.
Convert a time zone →UUID generator
Generate cryptographically random v4 UUIDs — one or a thousand at once, upper or lowercase, with one-click copy.
Generate UUIDs →Hash generator
Get the SHA-256, SHA-1, SHA-384, and SHA-512 hash of any text instantly — computed in your browser with Web Crypto.
Hash some text →Base64 encode / decode
Encode text to Base64 or decode it back — UTF-8 safe, with a URL-safe variant. Two-way and live, in your browser.
Encode or decode →URL encode / decode
Percent-encode text for a URL or decode it back — component mode for query values, full-URL mode that keeps separators. Two-way.
Encode or decode a URL →JSON formatter & validator
Beautify, validate, or minify JSON — with the exact line and position of any syntax error. In your browser.
Format some JSON →Regex tester
Test a regular expression against your text live — matches highlighted, flags you can toggle, and every capture group listed.
Test a regex →Text diff checker
Compare two texts or configs line by line — added and removed lines highlighted in a unified diff, real LCS algorithm.
Compare two texts →JSON diff
Compare two JSON objects structurally — added, removed, and changed keys by path, ignoring key order and formatting.
Diff two JSON objects →JSON ↔ CSV
Convert a JSON array of objects to CSV or CSV back to JSON — with correct quoting for commas, quotes, and newlines.
Convert JSON / CSV →YAML ↔ JSON
Convert YAML config to JSON or JSON to YAML — mappings, lists, nesting, comments, quotes. The everyday k8s/Compose/CI move.
Convert YAML / JSON →Password generator
Mint a strong random password — cryptographically secure, unbiased, with a live entropy strength meter.
Generate a password →Number base converter
See a number in hex, decimal, binary, and octal at once — auto-detects 0x/0b/0o, arbitrary-size integers.
Convert a number →Duration converter
Convert a duration across ms/seconds/minutes/hours/days — or parse 1h30m — with a human-readable form. For timeouts, TTLs, cron.
Convert a duration →Data size converter
See a size in decimal (KB/MB/GB/TB, ×1000) and binary (KiB/MiB/GiB/TiB, ×1024) at once — settles the 1000-vs-1024 confusion.
Convert a data size →Case converter
Convert a name between camelCase, snake_case, kebab-case, PascalCase, CONSTANT_CASE and more — all at once, handles mixed input.
Convert the case →Line tools
Sort, dedupe, trim, reverse, case-change, and number lines of text — for cleaning lists of IPs, hostnames, log lines, or keys.
Clean up a list →HTML entity encode / decode
Escape text to HTML entities (the core XSS defense) or decode named and numeric entities back. Two-way.
Encode or decode HTML →The tools spot the problems. Infraveil prevents them.
Every one of these checks is something Infraveil enforces continuously. Infraveil is a control plane you run on your own servers: it gates every production-changing action — deploys, migrations, restarts, AI-agent actions — behind your approval, with least-privilege access and a tamper-evident audit trail.
See the live demo →