Free online tools that run in your browser
Your files never leave your device · No login required · 100% free
Convert, compress, calculate, generate, edit and check files right in your browser — fast, private and easy to use.
Search results
Popular tools
View all toolsBrowse by category
Popular file conversions
View all convertersProgramming
Learn and practise programming in your browser. Pick a language: write code, run it in a real terminal and follow the lessons step by step.
Why Shiklo Tools?
Simple, private tools that just work — right in your browser.
- Private Everything runs in your browser. Files are never uploaded.
- Secure Encrypted HTTPS connection, and nothing you open is stored on our servers.
- No login required No account, no sign-up, no email. Just open a tool and use it.
- Fast No upload or download wait — results appear instantly.
- Free All tools are free to use, with no limits.
- Works everywhere Phone, tablet or computer, in any modern browser.
🆕 New tools
★ Popular tools
Recently used
Frequently asked questions
Are my files or text uploaded anywhere?
No. Every tool runs inside your browser on your own device. Nothing you enter or open is sent to a server.
Do I need to create an account or log in?
No login is required. There are no accounts — open any tool and start using it straight away.
Are the tools really free?
Yes. All tools are free, with no limits or watermarks. The site is supported by ads.
Does it work on my phone?
Yes. The tools work in any modern browser on phones, tablets and computers.
Can I use the tools offline?
Once a tool has loaded it does its work on your device, so it keeps working even if your connection drops.
Which file types are supported?
PDF, Word, Excel, PowerPoint, OpenDocument and RTF documents, JPG, PNG, WebP, HEIC, AVIF, GIF and BMP images, MP4, MOV, WebM and MKV videos, MP3, WAV, M4A, OGG and FLAC audio, ZIP, 7z, RAR, TAR and GZIP archives, CSV, JSON, XML and plain text. Each tool lists exactly what it opens.
All tools with descriptions →
Cookie Analyzer
Analyse Set-Cookie headers: Secure, HttpOnly, SameSite, expiry, domain, prefixes and size, with problems browsers reject and a fixed header.
Paste the Set-Cookie headers from a response, one per line as you copy them from the browser's developer tools or from curl -I, and the analyzer explains each cookie: when it expires, which sites and paths it is sent to, and what Secure, HttpOnly, SameSite and Partitioned mean for it. It flags problems that make browsers reject a cookie, such as SameSite=None without Secure or a broken __Host- prefix, and security warnings such as a session cookie readable by scripts, then suggests a corrected header to copy.
Values are decoded where possible: URL-encoded text, base64 JSON and JSON Web Tokens with their expiry. You can also paste a request Cookie header to list its cookies. Nothing is sent anywhere.
How to use Cookie Analyzer
- Copy the Set-Cookie headers from the Network tab in developer tools, or from curl -I.
- Paste them, one per line; other headers are ignored.
- Read each cookie's settings, problems and warnings.
- Copy the suggested header and update your server or framework settings.
Features
- Parses any number of Set-Cookie headers
- Checks SameSite, Secure, HttpOnly, Domain, Path and expiry
- __Host- and __Secure- prefix rules
- 400-day cap and 4 KB size limit
- Decodes URL-encoded, base64 JSON and JWT values
- Suggests a corrected Set-Cookie header
Cookie attributes in short
Each attribute controls where and how long a cookie is used.
| Attribute | What it does |
|---|---|
| Expires / Max-Age | When the cookie is deleted; without them it is a session cookie |
| Domain | Shares the cookie with subdomains; leave it out to keep it on one host |
| Path | Only sends the cookie for addresses under this path |
| Secure | Only sent over https |
| HttpOnly | Hidden from JavaScript, which protects it from XSS attacks |
| SameSite=Strict / Lax / None | Whether it is sent on requests from other sites |
| Partitioned | A separate copy per top-level site for embedded content (CHIPS) |
SameSite and third-party cookies
SameSite protects against cross-site request forgery. Strict never sends the cookie from another site, which can log users out when they follow a link to you; Lax sends it when the user navigates to your site but not on embedded requests and form posts from other sites, which is the right default for most session cookies; None sends it everywhere and must be combined with Secure. Chrome and Edge treat cookies without SameSite as Lax. Browsers increasingly restrict third-party cookies, so embedded widgets should use Partitioned cookies or other storage.
Cookie prefixes
Names that start with __Secure- or __Host- are a promise the browser enforces. A __Secure- cookie must have Secure. A __Host- cookie must also have Path=/ and no Domain, so it is locked to one exact host and cannot be overwritten by a subdomain or an insecure page. They are a cheap way to harden session and CSRF cookies.
Limits browsers enforce
A cookie's name and value together may be at most 4,096 bytes, and attribute values at most 1,024 bytes. Expiry dates more than 400 days away are shortened to 400 days. Browsers also limit the number of cookies per domain, typically around 180, and servers often reject requests whose Cookie header is too large, returning errors such as 400 or 431. Keep cookies small and store large data on the server.
Cookies and privacy rules
Session and security cookies that a site needs to work are usually allowed without consent, but analytics, advertising and tracking cookies often need the visitor's consent under laws such as the GDPR and the ePrivacy rules in Europe and India's DPDP Act. Listing the cookies your site sets, with their purpose and lifetime, is the first step towards an accurate cookie notice.
Frequently asked questions
Why is my SameSite=None cookie being rejected?
Browsers only accept SameSite=None together with Secure, so the cookie must be set over https with the Secure attribute.
Should session cookies be HttpOnly?
Yes. HttpOnly stops page scripts, including injected ones, from reading the cookie.
What is the difference between Expires and Max-Age?
Expires is a date, Max-Age a number of seconds. If both are set, Max-Age wins. Without either, the cookie is deleted when the browser closes.
What are __Host- cookies?
Cookies whose name starts with __Host- must be Secure, have Path=/ and no Domain. The browser enforces this, locking them to one host.
How do I see my site's Set-Cookie headers?
Open the developer tools (F12), go to Network, reload, click the page request and look at the response headers, or run curl -I followed by the address.
Are my cookies sent anywhere?
No. The headers are analysed in your browser.
Related tools
Security Headers CheckerCheck a website's HTTP security headers — HSTS, CSP, X-Frame-Options, Referrer-Policy and more — get a grade and how to fix each gap.
JWT DecoderDecode a JSON Web Token: header, payload, readable exp/iat dates and expiry status. Verify HS256, RS256, ES256 and more. Token stays on your device.
URL Encoder, Decoder & ParserEncode or decode URLs (percent-encoding), parse a link into its parts, and edit its query parameters in a table.
CSP GeneratorBuild a Content-Security-Policy header or meta tag from a strict starting point, and check any policy for common weaknesses.
Certificate DecoderDecode SSL/TLS certificates, chains, CSRs and public keys in PEM or DER: subject, issuer, expiry, SANs, key size, extensions and fingerprints.