Arsenly
Tools
Recon & Discovery16 tools Web Security Audit10 tools Exploitation & OOB3 tools Payloads & Wordlists4 tools Cryptography & Generators3 tools Encoders & Converters5 tools Reference & Reports4 tools
Browse the full catalogue Open /explore →
Free Tools
Recon & Discovery
SiteMapper ProTurn a URL list into 4 views: hierarchical host/path tree, sortable fl… URL & Endpoint ExtractorMine URLs, JS endpoints, domains and parameters from pasted source cod… CIDR / IP CalculatorIPv4 and IPv6 subnet math. Expand CIDRs, parse ranges and netmasks, ag…
Web Security Audit
Cookie / JWT AuditorAudit cookie flags (Secure, HttpOnly, SameSite, __Host- / __Secure- pr… OpenAPI / Swagger AnalyzerPaste or drop an OpenAPI 3 / Swagger 2 spec and map its attack surface…
Cryptography & Generators
Hash ToolkitGenerate (MD5, NTLM, SHA) and identify 60+ hash types with ranked cand… Test Data GeneratorRealistic-looking test data across 22 countries: names, emails, phone … Code / Password / Token GeneratorCustom-charset strings (1-512 chars, up to 5000 at a time), passwords …
Encoders & Converters
Encoder / Decoder4-tab workbench: 20+ encodings (URL, double-URL, percent-all, Base64, … HTTP Request ConverterConvert HTTP requests between 6 formats: Raw HTTP (Burp), curl, fetch(… JSON WorkbenchFormat, validate (with line / col error), minify, sort keys, unescape … Text Suite7-tab text workbench: regex find/replace, sort/dedupe/sample, keep-dro… Text Comparer4-tab diff workbench: true LCS line / word / char diff, side-by-side, …
See all 13 free tools on /explore →
Pricing
Resources
ChangelogWhat's shipped lately API DocsAutomate scans from your CLI About XowiaLabsWho's behind this ContactBug reports, ideas, just say hi Terms & PrivacyAcceptable-use policy + privacy
Sign in Get started
← All tools

Text Suite

Encoders & Converters Free · No sign-up

7-tab Swiss-army text workbench - regex find/replace, sort/dedupe/sample, line filter, set operations (diff two lists), URL-parts extraction, case transforms, secret extraction & stats.

Try it now No sign-up required. Runs entirely in your browser.
to
Compare two lists line-by-line. Useful for diffing scan results: e.g. yesterday’s subdomains vs today’s → only in B shows newly-discovered subdomains.
Pull a specific component out of every URL in the list - hostname, root domain, path, filename, query keys, etc. Lines that aren’t URLs are skipped.
Scan free-form text for URLs, emails, IPs, JWTs, API keys, private keys and other secrets. Stats panel shows line / word / char / byte counts, top-10 words and duplicate ratio.

What is Text Suite?

Text Suite is the text-wrangling workbench every bug-bounty / pentest workflow needs. Seven focused tabs cover every line-manipulation task that fills the day: regex find-and-replace with capture groups, sort + dedupe + shuffle + random-sample, keep/drop line filters, set-operations between two lists (the canonical "what subdomains are new today vs yesterday" diff), per-component URL extraction (host / root-domain / path / query-keys / extension / port), case transforms (camel / snake / kebab / etc.), per-line prefix/suffix/wrap-in-quotes, and a secret-extractor + stats panel for arbitrary text.

Built specifically for the data shapes pentest workflows actually produce: subdomain lists from Subdomain Discovery, URL lists from Wayback URL Extractor, hostname lists from HTTP ProbeMaster, JS bundles for secret hunting, and CSV dumps for column extraction. 100% client-side - even very large lists (50k+ lines) stay in your browser.

What it does

  • Find & Replace - regex (with literal-escape toggle), case-insensitive, optional per-line mode, capture-group substitution with $1, $2, plus a "Count matches" preview.
  • Sort, Dedupe, Sample - 8 sort modes (alpha asc/desc, length asc/desc, numeric asc/desc, by suffix for subdomain-friendly ordering, no-sort), case-insensitive dedupe, shuffle, reverse, and reservoir-sampled random N.
  • Filter Lines - keep / drop lines by substring or regex, case-insensitive, plus length-range filter (min/max chars).
  • Set Operations - diff two lists with one click: Only in A, Only in B, Common (A ∩ B), Union (A ∪ B), Symmetric diff. Case-insensitive toggle.
  • URL Parts - pick a component (hostname / root-domain via eTLD+1 heuristic / subdomain prefix / scheme / port / path / filename / extension / full query / query keys / key=value pairs / origin / fragment) and extract it from every URL in the list. eTLD+1 logic handles 2-label TLDs (co.uk, com.au etc.) correctly.
  • Transform - 10 case modes (upper, lower, title, sentence, camel, pascal, snake, kebab, constant, invert), trim each line, remove empty lines, number lines, reverse each line, prefix/suffix per line, wrap each line in '' / "" / `` / () / [] / {} / <>, join with separator, split by separator.
  • Extract & Stats - scan free text for URLs, emails, IPv4, JWTs, AWS access keys, GitHub PATs, Slack/Stripe/OpenAI keys, MongoDB URIs, Slack webhooks, bearer tokens, private keys. Stats: lines, non-empty, unique, dup ratio, words, chars, bytes, top-10 words.
  • Local-only - 100% client-side. Even 50k-line lists never leave the browser.
  • Tab-aware Copy / Download / Clear - the toolbar at the bottom operates on whatever pane is active.

Where it fits in your workflow

  • →Diff today’s subdomain scan against yesterday’s - Set Operations → Only in B = newly-discovered subdomains worth investigating today.
  • →Clean a URL list from gau / waybackurls - Sort & Dedupe with "Drop empty", then URL Parts → "Query keys" to find all parameter names ever used.
  • →Convert a list of usernames to "user1","user2",... for a SQL IN clause - Transform → wrap each line in "", then join with ,.
  • →Pull every email address out of a leaked dump - Extract & Stats → click Extract.
  • →Sub-sample 100 URLs from a 100k-URL list for quick fuzzing - Sort & Dedupe → Random sample N=100.
  • →Convert a CSV column to lowercase + dedupe - paste, Transform → lowercase, then Sort & Dedupe → Apply.
Want more?

This one is free in your browser. Sign up for server-side recon, scan history, and projects.

Create free account Sign in

At a glance

CategoryEncoders & Converters
RunsIn your browser
Token cost Free - no tokens
Access No login needed
Status● Live

Frequently asked questions

What is "sort by suffix"?

Sorts lines by their reversed string, which groups subdomains of the same parent together. api.example.com, www.example.com and cdn.example.com end up adjacent, making it easy to spot patterns in a huge subdomain list.

How accurate is the root-domain extraction?

It uses a curated list of the most common 2-label ccTLDs (co.uk, com.au, co.jp, etc.) and falls back to the last 2 labels. Not a full Public Suffix List, but correct for the cases pentest workflows actually hit. If you need PSL accuracy, run the output through a dedicated tool.

Is the secret extraction the same as KeyHacks Scan?

Similar but lighter - this version covers ~14 of the most common high-signal patterns. For full coverage (74 patterns, with the validation command for each) use the dedicated KeyHacks tool.

Does anything ever go to the server?

No. 100% client-side. Every operation runs in your browser; pasted text never touches our servers.

Other free tools you might like

OpenAPI / Swagger Analyzer

Paste or drop an OpenAPI 3 / Swagger 2 spec and map its attack surface in your browser. Flags endpoints with no auth requirement, BOLA / IDOR candidates (object-returning routes keyed by id), mass-assignment surface, overly-permissive schemas, verbose error shapes and deprecated routes. Summarises servers, auth schemes and tags, and generates a ready-to-run curl request collection for Burp handoff. Fully client-side, nothing is uploaded.
Encoder / Decoder

4-tab workbench: 20+ encodings (URL, double-URL, percent-all, Base64, Base64URL, HTML, JS \xXX / \uXXXX, CSS, Hex, Binary, Octal, ASCII, ROT-N, Atbash, Morse), all-encodings multi-view, hashes (MD5, SHA family, HMAC), and Unix-timestamp / ISO 8601 conversions.
JSON Workbench

Format, validate (with line / col error), minify, sort keys, unescape stringified, convert to YAML / XML / CSV / PHP / JS / JSONL / query, JSONPath query, two-pane diff, extract secrets (URLs / emails / JWTs / AWS / Stripe / private keys), depth and type stats. 100% client-side.
Explore more tools →