Hexyr

Hexyr is a local-first developer hex and encoding toolkit for quickly understanding unknown payloads. It's designed to be a Swiss-Army knife for developers who constantly need to encode, decode, inspect, and understand data.

Screenshots

Desktop - HTTP Signer:

Core Features

• Universal Inspector (paste-anything workflow)
• Text <-> Hex, Base64, Binary transforms
• URL and HTML entity encode/decode
• Unicode inspection (code points, UTF-8 bytes, UTF-16 units)
• JWT inspector with decode warnings and claim highlighting
• Hexdump formatter with offsets and ASCII preview
• Hash + HMAC helpers via Web Crypto
• Bitwise operations, endianness swap, IPv4/int conversion, timestamp conversion
• Entropy, stats, frequency hints, magic byte detection
• Deterministic explainers (rule-based, no external AI)
• DNS toolkit (zone parse/format/validation + TTL sanity)
• Webhook signature verifier (Stripe/GitHub/Slack)
• HAR inspector (header/cookie extraction + anomaly + redaction export)
• Cookie/Jar analyzer (flag and expiry validation)
• UUID/ULID/KSUID utility (generate/validate/timestamp/entropy)
• Timezone/ISO8601 lab (cross-timezone normalization)
• Policy linter pack (CSP/CORS/security headers)
• Formatter lab (JSON/YAML/TOML/XML/INI/SQL/HTTP + converter)
• ASCII art generator (text fonts + image-to-ASCII, local processing)

Universal Inspector

/inspect is the primary mode:

• Accepts pasted input or dropped files
• Detects likely formats (hex/base64/base64url/binary/JWT/JSON/etc.)
• Shows warnings and metadata
• Suggests and links to specialized tools while preserving workspace input

Architecture Overview

• src/app: React SPA, UI shell, routes, feature workspaces
• src/shared: Pure deterministic utilities (encoding, detection, parsing, analysis, crypto, explainers)
• src/worker: Thin Hono Worker for /api/health and /api/meta
• tests: Vitest unit tests for deterministic modules

Core transforms run client-side by default. The Worker is intentionally lean and future-ready.

Privacy Model

• Payload transforms are client-side in MVP
• No backend persistence
• No payload-content logging
• No Cloudflare KV
• localStorage is used only for non-sensitive UI preferences (theme, last selected tool)

Local-First Rationale

Local execution keeps interactions faster, lowers edge complexity, and reduces risk when developers inspect sensitive payloads.

Cloudflare Notes

• Deployment target: hexyr.com
• Docs target: docs.hexyr.com
• Runtime: Cloudflare Workers + static SPA assets
• SPA fallback is configured for routes like /tool/hex
• API namespace is explicit under /api/*
• KV is intentionally not used

SEO and Crawlability

• robots.txt is included in public/robots.txt
• XML sitemap is included in public/sitemap.xml
• Canonical, Open Graph, and Twitter metadata are configured in index.html

Routes

• /
• /inspect
• /tool/hex
• /tool/base64
• /tool/binary
• /tool/url
• /tool/html
• /tool/unicode
• /tool/jwt
• /tool/hash
• /tool/bitwise
• /tool/hexdump
• /tool/dns
• /tool/webhook
• /tool/har
• /tool/cookies
• /tool/ids
• /tool/timezone
• /tool/policy
• /tool/format
• /tool/ascii
• /api/health
• /api/meta
• /api/tools

API Reference

Hexyr exposes integration-friendly JSON endpoints under /api/tools/*. OpenAPI spec: /openapi.json (local: http://localhost:5173/openapi.json, prod: https://hexyr.com/openapi.json).

Health / metadata

• GET /api/health
• GET /api/meta
• GET /api/tools (lists available tool endpoints)

Tool endpoints

• POST /api/tools/dns
  • body: { "zoneText": "...", "format": true }
  • returns parsed records, syntax/TTL diagnostics, optional formatted zone output
• POST /api/tools/webhook-verify
  • body: { "provider": "stripe|github|slack", "payload": "...", "secret": "...", "signatureHeader": "...", "timestampHeader": "..." }
  • verifies signatures for Stripe/GitHub/Slack webhook payloads
• POST /api/tools/har-inspect
  • body: { "harText": "...", "redactionExport": true }
  • returns entry summary, anomalies, and optional redacted HAR export
• POST /api/tools/cookie-analyze
  • body: { "setCookieText": "Set-Cookie: ..." }
  • parses cookies and validates Secure/HttpOnly/SameSite/expiry issues
• POST /api/tools/id-inspect
  • body: { "id": "..." }
  • detects UUID/ULID/KSUID, validates format, returns timestamp/entropy hints
• POST /api/tools/time-convert
  • body: { "input": "...", "zones": ["UTC", "America/New_York"], "sourceZone": "UTC" }
  • worldtimebuddy-style normalization and timezone conversion output
• POST /api/tools/policy-lint
  • body: { "rawHeaders": "HTTP/1.1 200 OK\ncontent-security-policy: ..." }
  • lints CSP, CORS, and common security headers
• POST /api/tools/format
  • body: { "input": "...", "kind": "json|yaml|toml|xml|ini|sql|http", "mode": "format|minify|validate", "from": "json|yaml|toml", "to": "json|yaml|toml" }
  • formats/minifies/validates many payload types, and converts JSON/YAML/TOML
• POST /api/tools/dns-tool
  • body: { "tool": "MX Lookup", "target": "example.com" }
  • runs DNS Toolkit checks (MX/A/AAAA/TXT/DMARC/SPF/RDAP/health and more)

Local Development

pnpm install
pnpm dev

Build

pnpm build
pnpm preview

Deploy to Cloudflare Workers

1. Set secrets or env vars:
   • CLOUDFLARE_API_TOKEN
   • CLOUDFLARE_ACCOUNT_ID
2. Authenticate Wrangler if needed:

pnpm exec wrangler login

3. Deploy:

pnpm run deploy

Recommended Cloudflare API Token Scope (Least Privilege)

Create a custom token scoped only to the Hexyr account/zone:

• Account: Workers Scripts:Edit
• Account: Workers Routes:Edit
• Account: Workers Tail:Read (optional)
• Zone (hexyr.com only): Zone:Read
• Zone (hexyr.com only): DNS:Edit (only if managing custom-domain DNS via deploy)

Avoid broad global tokens; keep access limited to the hexyr.com zone and the owning account.

GitHub Actions

• CI workflow runs lint, typecheck, test, and build on PRs and main pushes.
• Security SAST workflow runs CodeQL, dependency review (PR), and secret scanning via Gitleaks.
• Security DAST workflow runs OWASP ZAP baseline against https://hexyr.com on schedule and manual dispatch.
• Production deploys are handled by Cloudflare's GitHub integration for this Worker service.

Security Scanning Notes

• SAST findings are surfaced in GitHub Security alerts when Advanced Security/Code scanning is enabled.
• DAST is non-destructive baseline crawling and report generation.
• You can manually run DAST with a custom URL from the Actions tab (target_url input).

Contributing

Community contributions are welcome. Please read CONTRIBUTING.md for branch/PR workflow, quality gates, and privacy/security expectations.

For verified commit setup, see SIGNING.md.

If you prefer GitHub-based deploys later, add back a deploy workflow with Cloudflare secrets.

Project Structure

src/
  app/
  shared/
  worker/
tests/
.github/workflows/

Testing

Run all tests:

pnpm test

Includes deterministic coverage for encoding, detection, parsing, entropy, magic bytes, and crypto helpers.

Security Notes

• Hexyr is decode/inspection focused.
• JWT decode is not signature verification.
• Do not treat decoded JWT payloads as trusted unless signature and claims are validated in your own auth context.
• Avoid pasting production secrets into third-party tools; Hexyr is built to keep this local-first.

Roadmap Ideas

• Structured compare mode for two payloads
• Optional local-only encrypted workspace snapshots
• Additional file signature and container format coverage
• Advanced command palette and keyboard workflows
• Large payload virtualization improvements

License

Apache-2.0