Small, sharp tools for Microsoft 365 and Windows admins
Five things I got tired of doing by hand: reading message headers, decoding tokens, converting identity values between the four shapes Microsoft uses for them, making sense of a Conditional Access export, and unpacking a base64 PowerShell command at 2am. They all run entirely in your browser — nothing you paste ever leaves the page.
Tools
Message Header Analyzer
Paste the internet headers of a message and read the delivery path, hop delays, SPF/DKIM/DMARC verdicts, SCL and BCL — with what each value actually means.
Entra IDEntra ID Token Decoder
Decode an access or ID token and see every claim explained, directory roles resolved by name, and the traps that break token validation.
Hybrid identityGUID, ImmutableID & SID Converter
objectGUID to ImmutableID and back, binary SIDs to S-1-5-… and back, plus the escaped octet strings you need in an LDAP filter.
Entra IDConditional Access Explainer
Drop in a Conditional Access policy exported from Graph and get a readable summary — who it hits, what it requires, and where it can lock you out.
Incident responsePowerShell EncodedCommand Decoder
Decode a base64 -EncodedCommand payload, peel nested layers, and get the URLs, IPs and behaviours worth triaging first.
Why these five
Each one exists because the alternative is a portal that shows you a raw value with no
explanation, or a PowerShell one-liner you have to look up every time. They give you the value
and what it means: an SCL of 5 says the anti-spam policy's "Spam" action applied, a
compauth reason of 001 says implicit authentication failed, a wids GUID resolves to
"Global Administrator" and is flagged as privileged.
No accounts, no telemetry, no tenant access
These pages are static HTML and JavaScript. There is no backend, no analytics, no cookie, and no call to Microsoft Graph. That is deliberate: the values you paste into an admin tool — tokens, headers, tenant IDs — are exactly the values you should not be handing to a stranger's server. View the source of any page and you can confirm it.