The pentester's toolkit. A fast, modern, self-hostable collection of the tools you actually reach for: encoding/decoding, hashing, hash identification, crypto, formatting, regex, conversions, generators and binary forensics. Everything runs in your browser. No backend, nothing uploaded.

Status: the complete client-side toolset (the 1.0 line). An optional backend (WHOIS/RDAP, passive DNS, server-backed auth, update checks) and a one-image Docker deployment are the planned 2.0 phase (see Roadmap).

Features

• Encode / Decode: Base64 · Base32 · Base58 · Hex · URL encode · URL parse · HTML entities · JWT decoder · Magic auto-decoder
• Crypto: hash text (MD5 → SHA-3 / BLAKE2) · HMAC · streamed file hashing · hash-type identifier · AES encrypt/decrypt · XOR · ROT/Caesar · classical ciphers
• Format: multi-language beautifier (JSON · YAML · XML · SQL · JS/TS · HTML · CSS/SCSS/LESS · GraphQL · Markdown) · dedicated JSON & SQL formatters · convert between JSON / YAML / CSV / TOML
• Regex: live tester with match highlighting · plain-English explainer
• Convert: Unix timestamps · number-base converter · text diff · Unicode inspector
• Generate: UUID / ULID · secure passwords · random tokens · QR codes
• Network: scope cleanup - normalize a messy engagement scope (mixed CIDRs, ranges, single IPs, URLs, host:port, IPv6, hostnames, dupes) into a deduped host list for nmap -iL, the minimal set of collapsed CIDRs, or a single nmap-ready target string · MAC vendor lookup against the IEEE OUI registry (~53k MA-L/M/S prefixes) with unicast/multicast + universal/local bit decoding and randomized/private-MAC detection
• Forensics / DFIR: IOC defang/refang + IOC extraction · Windows .lnk shortcut parser (target/args, MAC timestamps, origin machine + MAC address) · multi-format forensic timestamp decoder (FILETIME, Chrome/WebKit, Cocoa, APFS, OLE, DOS…) · EXIF / metadata viewer (GPS→map, camera, privacy findings) · strings-style extraction · QR decode · email header analyzer (Received hop chain + delays, SPF/DKIM/DMARC, phishing tells)
• Windows / AD: security-descriptor (SDDL, ACLs, AD GUID names), Kerberos .kirbi, SID and PowerShell -EncodedCommand decoders · GPP cpassword decrypt · userAccountControl and FILETIME / Integer8 converters · NTSTATUS / HRESULT / Win32 error-code decoder (~9,000 codes)
• Linux: passwd/shadow, /etc/group, sudoers (GTFOBins-aware, reads sudo -l), SSH authorized_keys, capabilities and systemd-unit analysis · ls -l permission triage · crontab explainer - each flagging privilege-escalation red flags
• Web: SAML decoder/encoder · HTTP security-header + CSP analyzer · signed session-cookie decoder (Flask/itsdangerous, JWT, Django) · serialized-blob identifier (Java/ViewState/PHP/Ruby/pickle)
• Reversing / Binary: ELF checksec (RELRO/NX/PIE/canary/Fortify) · PE inspector (headers, ASLR/DEP/CFG, sections + entropy, imports) · Mach-O parser (fat binaries, dylibs, signing) · multi-arch disassembler (WASM Capstone - x86/x64/ARM/ARM64/Thumb/MIPS) · entropy visualizer · ASN.1 / DER decoder (X.509/PKCS, named OIDs)
• Red Team: C2 redirector config generator (nginx / Apache mod_rewrite from a Cobalt Strike malleable profile) · malleable C2 profile linter (OPSEC red flags: sleep/jitter, staging, default UA / pipe / cert) · vulnerable-driver lookup against the LOLDrivers catalog (BYOVD candidates, HVCI-loading flag). All infrastructure and analysis, entirely client-side.

Every tool is a self-contained folder under src/tools/; dropping a new one in registers it automatically across the nav, palette and launcher.

Settings & access

A settings menu (top-right) persists your choices locally:

• Theme: light / dark / automatic.

• Cracking tool: You can set your desired cracking tool and the Hash Identifier tailors the commands and flags it generates to your choice.

• Password gate (optional): lock the instance behind a password. The password is stored only as an Argon2id hash (random salt) in localStorage, never in recoverable form, and you pick how often you're re-prompted (every launch / daily / weekly). It enforces a 10-character minimum with upper / number / special requirements.

  ⚠️ Because 1.0 is 100% client-side, the password gate is a deterrent, not a hard boundary. Anyone with devtools or filesystem access to the machine can bypass a client-side check. For real enforcement on a shared instance, put it behind your reverse proxy (basic-auth / SSO); server-backed auth is planned for 2.0.

Hash identification

The Hash Identifier recognizes credentials and raw hashes across Active Directory / Kerberos (Kerberoast & AS-REP), NetNTLM, /etc/shadow, databases, network devices, documents, archives and many raw-hash formats. For each likely match it emits a ready-to-run hashcat (-m …) and/or John (--format=…) command. It flags malformed input instead of guessing on a prefix alone, and you can attach a wordlist, rules file, and GPU / workload / fork options right from the UI.

It bundles hashcat's authoritative mode → name → example table (src/tools/hash-id/hashcat-modes.generated.ts, pulled from hashcat's MIT-licensed example_hashes). Run npm run update:hash-defs to refresh it; the script also cross-checks our curated detectors against the authoritative list and flags any mode mismatches.

Tech stack

Vite · React 18 · TypeScript · Tailwind CSS v4 (OKLCH tokens) · cmdk · lucide · hash-wasm (hashing + Argon2id) · self-hosted variable fonts (offline-safe). Heavy work is code-split per tool and moves into Web Workers where it matters.

Download & run (no build)

Most people don't need to build anything. Grab the prebuilt bundle from the latest release and unzip it. Then, from inside the folder, serve it with any static web server:

npx serve                    # Node (Windows, macOS, Linux)
python -m http.server 8000   # Python (use python3 on macOS/Linux)

Then open the printed URL, or point nginx / Caddy at the folder. Routing is hash-based, so no rewrite rules are needed, and each release ships a .sha256 to verify the download.

Build & run from source

Requires Node 20+ (Node 24 LTS recommended).

npm install
npm run dev        # dev server at http://localhost:5173 (hot reload)

Production build (static files, host them anywhere):

npm run build      # type-checks then builds to ./dist
npm run preview    # serve the built ./dist locally to verify

The contents of dist/ are fully static. Drop them behind any web server (nginx, Caddy, python -m http.server, GitHub Pages, etc.). Because routing is hash-based, no server rewrite rules are needed.

Scripts

Script	What it does
npm run dev	Start the Vite dev server
npm run build	Typecheck + production build to dist/
npm run preview	Preview the production build
npm run typecheck	tsc --noEmit
npm test	Run the Vitest unit tests
npm run update:hash-defs	Re-pull hashcat's mode table into the Hash Identifier

Adding a tool

See docs/AUTHORING_TOOLS.md. In short: create src/tools/<id>/ with meta.ts, Tool.tsx, logic.ts and logic.test.ts, following the base64 reference. No central registration needed.

Privacy

Every tool runs entirely client-side: there is no backend, and nothing you paste or upload leaves your browser. The optional password gate is local too (an Argon2id hash in localStorage). Note that browser-side hashing/crypto is for tooling and analysis, not a substitute for audited production key handling.

Roadmap

Shipped

• Auto-discovering tool registry, theming, command palette, shareable hash-routing
• Client-side toolset: encode · crypto · format · regex · convert · generate · forensics
• Settings (theme, cracker choice) + optional Argon2id password gate
• Windows / AD: security-descriptor (with dangerous-ACL findings), Kerberos, SID and PowerShell EncodedCommand decoders, GPP cpassword, userAccountControl and FILETIME/Integer8
• Linux: passwd/shadow, /etc/group, sudoers, ls -l permissions, authorized_keys, capabilities, systemd-unit and crontab triage with privesc red flags
• Web: SAML decode/encode, security-header + CSP analysis, signed session-cookie and serialized-blob decoders
• Forensics / DFIR: IOC defang/refang, .lnk shortcut parser, multi-format timestamp decoder, EXIF/metadata viewer, email header analyzer (Received chain, SPF/DKIM/DMARC); plus a NTSTATUS/HRESULT/Win32 error-code decoder
• Reversing: ELF checksec, PE and Mach-O parsers, a WASM-Capstone multi-arch disassembler, entropy visualizer, ASN.1/DER decoder
• Network: scope cleanup (expand / collapse to CIDRs / nmap-ready targets) and an IEEE MAC-vendor lookup with randomized-MAC detection
• Red Team: C2 redirector config generator (nginx / Apache), malleable C2 profile linter, and a LOLDrivers vulnerable-driver lookup

More tools

• Network (backend-dependent): DoH / reverse-DNS sweeps, WHOIS/RDAP (moves to the 2.0 backend phase)
• Steganography: EXIF / LSB / magic-byte carving
• AI text transform pack: Unicode tricks, emoji steganography, classical ciphers

Windows / Active Directory

• Kerberos ticket decryption: supply the krbtgt/service key to unseal the ticket and parse its PAC
• Security-descriptor GUID resolution from an imported (or backend-queried) forest schema, including forest-specific rights like LAPS

Platform

• Shareable tool-state permalinks + PWA update prompts

2.0 - backend & deployment

• Optional Go backend (WHOIS/RDAP, passive DNS/geo, server-backed auth/SSO, /api/update-check)
• One multi-arch Docker image (GHCR, cosign-signed) + in-app "update available" banner

Changelog

See CHANGELOG.md for the full release history.

License

GNU Affero General Public License v3.0 (AGPL-3.0). sappr is free and open source: you can use, study, share and modify it. The catch that keeps it open: if you distribute it, or run a modified version as a network service, you must release your full source under the same AGPL terms. Fork it and build on it all you like, but your version has to stay open too.

The bundled hashcat mode table (src/tools/hash-id/hashcat-modes.generated.ts) is MIT-licensed (GPL-compatible) and keeps its original terms; see THIRD-PARTY-LICENSES.md for the full notice.