Does this tool scan a website?
No. It analyzes only text or HAR JSON you provide. It never contacts the response URL, Origin, CSP report endpoint, or any other host.
Security Headers / CSP / CORS Inspector
Inspect pasted HTTP response headers, curl output, or HAR data. Parse CSP and browser isolation headers, then compare CORS against explicit request context without fetching a URL.
Local input limit: 2 MB · Processing timeout: 8 s
How can I verify this?
Open your browser DevTools and the Network panel, optionally clear existing requests, then run the tool. Page assets or consent-based analytics may still load, but tool payloads, files, keys, and results are not sent for processing.
Inspect supplied response headers
Paste a response/header block, curl -I output, curl verbose response lines, or HAR JSON. Add request context only when you want CORS comparisons. DecodeLens never requests the response URL.
Header analysis
Header inventory, CSP policies, explicit CORS comparisons, structural checks, and findings will appear here.
Evidence-backed header diagnostics
DecodeLens preserves ordered duplicate headers, keeps enforced CSP separate from report-only policies, and compares CORS only when request context is available. Findings identify whether a statement is observed, standards-backed, or heuristic.
No remote scan, browser simulation, or security grade
- No URL, origin, report endpoint, HAR request, or response target is fetched, replayed, or tested.
- Header presence is not a security guarantee. Correct policy depends on the application, browser behavior, response type, deployment, and surrounding controls.
- CORS results compare pasted values only. Preflight caching, redirects, service workers, cookies, authentication, CDN behavior, and server routing are not reproduced.
- CSP parsing inventories directives and focused diagnostics; it does not execute a document, prove exploitability, or compute one security score.
Related tools for this workflow
Continue with tools that decode, convert, inspect, or verify the same data.
- API & network
Raw HTTP Request & Response Inspector
Parse raw HTTP/1.x messages, inspect framing and multipart bodies, reconstruct HTTP signature bases, compare Content-Digest, and optionally verify supplied-key signatures.
Open tool - API & network
HAR File Analyzer & Sanitizer
Analyze HAR requests, failures, timing, transfer sizes, bodies, and sensitive fields; export a separate redacted copy.
Open tool - Developer Utilities
URL Parser & Builder
Inspect URL components and query parameters, edit them, and rebuild a valid URL.
Open tool - Security & identity
OAuth / OIDC Flow Inspector
Inspect OAuth 2.0 and OpenID Connect authorization URLs, callbacks, state, nonce, PKCE, tokens, and pasted discovery metadata without contacting the issuer.
Open tool
Response headers with optional request context
Paste the example to see enforced and report-only CSP separated, then review CORS checks that use an explicit Origin, method, credential mode, and requested header list.
Supplied evidence
response headers + optional Origin/method/credentialsExplicit diagnostics
inventory → CSP policies → CORS comparisons → findingsSecurity Headers / CSP / CORS Inspector FAQ
Is a present header automatically secure?
No. Presence, valid syntax, contextual fit, browser enforcement, and application security are different claims. The tool keeps them separate and does not issue a grade.
Why can a CORS check say Not compared?
Some CORS decisions require request-side evidence such as Origin, method, credential mode, or requested headers. DecodeLens does not invent missing context.