Fast. Open-source. No install required.
Crafting a correct payload or command by hand usually means digging through man pages, --help output, or scattered docs first. Payloadify skips that: click through a few options and get a ready-to-use command or payload straight away — think iLovePDF, but for pentesters, bug bounty hunters, OSCP/CEH students, and red teamers who land on a specific tool via search, use it once, and leave.
Live at payloadify.com.
Each tool lives at its own URL (e.g. /jwt-decoder), never a shared blank-canvas app.
- JWT Decoder/Tamper & Generator (
/jwt-decoder) — decode header/payload, flagalg:noneand weak signing, edit claims and re-sign. Or generate a JWT key with example templates - Hash Identifier (
/hash-identifier) — identify a hash's likely type with ranked candidates and matching Hashcat mode numbers - Hash Generator (
/hash-generator) — generate MD5, SHA-1, SHA-256, SHA-384, SHA-512, and NTLM hashes from text, tab-linked with the Identifier - Payload Encoder (
/payload-encoder) / Decoder (/payload-decoder) — chain Base64, Hex, URL, HTML-entity, and Unicode-escape steps to build or unwrap obfuscated payloads - Homoglyph Identifier (
/homoglyph-identifier) — detect Unicode homoglyph/confusable characters in suspicious text (e.g. spoofed domains) - Homoglyph Generator (
/homoglyph-generator) — generate homoglyph-substituted lookalike strings - XSS Payload Generator (
/xss-generator) — build XSS payloads across basic to advanced WAF-bypass and encoding techniques, for reflected/stored or DOM-based contexts - SQLi Payload Generator (
/sqli-generator) — build SQL injection payloads across MySQL, MSSQL, PostgreSQL, Oracle, and SQLite, with chainable info extraction, WAF-evasion obfuscation, and blacklist-character avoidance - Reverse Shell Generator (
/reverse-shell-generator) — generate reverse shell one-liners across Bash, Netcat, Python, PHP, Perl, Ruby, Socat, Awk, Telnet, Node.js, Lua, Golang, and PowerShell, with a matching listener command and save-as-file options - MSFVenom Command Generator (
/msfvenom-generator) — build msfvenom commands with template presets for Windows, Linux, macOS, and Android payloads, evasion encoders, and architectures, with a listener setup guide - CVSS 3.1/4.0 Calculator (
/cvss-calculator) — click-through vector builder for both CVSS versions, with vulnerability templates, chained-vulnerability scoring, OWASP mapping, and copyable VRT scores and references - Hashcat Command Generator (
/hashcat-generator) — build hashcat commands from mode, attack type, wordlists, rules, and masks, chained directly from the Hash Identifier - Subdomain Permutation Generator (
/subdomain-permutation-generator) — generate resolver-ready subdomain wordlists from environment, service, and region tokens plus custom keywords - HTTP Security Headers Analyzer (
/security-headers-analyzer) — check any URL's response headers against the OWASP Secure Headers Project - SPF/DKIM/DMARC Checker (
/spf-dkim-dmarc-checker) — check a domain's email authentication setup: SPF mechanisms and lookup count, DKIM selectors, and DMARC policy
Visit payloadify.com — everything runs in your browser.
git clone https://github.com/yourusername/payloadify.git
cd payloadify
npm install
npm run devOpen http://localhost:3000.
Other scripts:
npm run build # static production build (outputs to /out)
npm run lint # eslint
npm run test # vitestMost tools run client-side only — your data never leaves your browser. Paste, generate, copy. That's it. There's no database, no accounts, and no login. A backend (Cloudflare Worker) is used only where it's genuinely unavoidable: the HTTP Security Headers Analyzer and SPF/DKIM/DMARC Checker need to make outbound DNS/HTTP lookups that a browser can't perform directly, so those requests are proxied through an SSRF-guarded Worker.
- Frontend: Next.js (static export), React, TypeScript
- Styling: Tailwind CSS
- Hosting: Cloudflare Pages (free tier)
- Testing: Vitest
app/ Route pages — one folder per tool URL (e.g. app/jwt-decoder/)
components/ UI, organized by tool (components/tools/<tool-name>/) and shared/site chrome
lib/ Framework-free core logic per tool (encoding, hashing, generation, validation)
public/ Static assets (favicons, manifest)
scripts/ One-off data build scripts (not part of the app runtime)
- Client-side processing — no server, no data collection
- Open source — audit the code yourself
- No tracking, no analytics, no ads
- Spec-compliant outputs (RFC 7519, msfvenom format, Hashcat mode numbers, etc.)
This project is built with AI-assisted development (Claude Code). Because correctness is the whole point of a tool like this, generated code and payload/scoring logic are manually reviewed and spot-checked against known-good references before shipping — e.g. CVSS vectors verified against FIRST.org's calculator, and payload/command syntax checked against established sources rather than trusted blindly.
JWT Decoder/Tamper & JWT Generator — all signing, verification, and key
generation (HS256/384/512, RS/PS/ES families) run on the browser's native
Web Crypto API;
no third-party crypto library ships in production for these tools.
jose (MIT License, © Filip Skokan) is used
as a dev/test-only dependency to cross-verify that the Web Crypto
implementation produces spec-correct output — it is not part of the shipped
bundle.
Found a bug? Want to add a tool? See CONTRIBUTING.md.
MIT License — see LICENSE for details.
Made by a pentester, for pentesters.
Feedback? Open an issue on GitHub.