AdminForge

A self-hosted toolbox of browser-based utilities for sysadmins, IT and security engineers.

Subnets, certificates, DNS, mail records, Windows error codes and the rest of the daily lookups — in one container you run yourself.

No sign-up, no accounts, no telemetry. The JWT decoder, password generator, hash generator and encoder never send what you type anywhere; the other nine tools run on the AdminForge instance itself — your own, when you self-host.

---

Run it in 30 seconds

docker run -d --name adminforge -p 8080:8080 ghcr.io/juandresrodca/adminforge:latest

Then open http://localhost:8080. That is the whole installation: no database, no accounts, no configuration file, no reverse proxy required to get started.

docker compose

services:
  adminforge:
    image: ghcr.io/juandresrodca/adminforge:latest
    ports:
      - "8080:8080"
    restart: unless-stopped
    read_only: true
    tmpfs: [/tmp]
    environment:
      # Homelab? Turn this  on  to let the network tools reach your LAN.
      # Leave it off for anything reachable  from the internet.
      AdminForge__AllowPrivateTargets: "false"

From source

Needs the .NET 10 SDK and nothing else.

git clone https://github.com/juandresrodca/AdminForge.git
cd AdminForge
dotnet run --project src/AdminForge.Web

Running it for more than yourself — reverse proxy and TLS, the authentication AdminForge deliberately does not have, the AllowPrivateTargets decision, air-gapped hosts and updates: → Self-hosting guide.

---

Why this exists

There are good browser toolboxes already — and they are all aimed at web developers. Ask one of them how many days are left on a certificate, whether a domain's SPF record is about to blow the ten-lookup limit, or what 0x80070005 means, and you are back to five open tabs.

AdminForge is the same idea pointed at infrastructure work:

• Self-hosted, in one container. Lookups run from your own instance rather than through somebody else's website, so the certificate you are checking, the domain you are auditing and the token you are decoding are never handed to a third-party toolbox.
• Honest about where your data goes. Every tool is labelled In browser or Server side, and anything that could touch a secret is built to run in the browser and never make a request at all.
• No third-party requests of its own. No CDN, no analytics, no telemetry, no web fonts. A tool connects out only when it has to — to the host you are checking, your DNS resolver, or, for registration lookups, rdap.org and the registry it redirects to. The app itself works air-gapped.
• Tilted at sysadmins and security, not at front-end work. That is the whole point.

---

What is in it

Thirteen tools today, across six categories. Each one has a reference section — inputs, limits, and whether it makes an outbound request — in the tool reference.

Network

Tool	Runs	What it does
Subnet calculator	Server	Network, broadcast, usable range, mask, wildcard and host count for IPv4 and IPv6 — plus splitting a block into equal subnets
DNS lookup	Server	A, AAAA, MX, TXT, NS, CNAME, SOA, CAA, SRV and PTR against the system resolver or one you choose
RDAP and WHOIS lookup	Server	Who registered a domain or owns an IP range, with registration and expiry dates

Security

Tool	Runs	What it does
TLS certificate checker	Server	Real handshake: expiry, chain, SANs, issuer, key strength, signature algorithm and negotiated protocol
HTTP security headers	Server	Weighted grade across CSP, HSTS, X-Frame-Options and the rest, plus the headers that advertise your stack
JWT decoder	Browser	Header, claims and expiry, interpreted — and the token never leaves your machine
Password generator	Browser	Passwords and passphrases from crypto.getRandomValues, with the real entropy
Hash generator	Browser	MD5, SHA-1, SHA-256, SHA-384, SHA-512, and checksum verification
security.txt validator	Server	Whether a domain publishes an RFC 9116 disclosure contact, and whether it is still in date

Windows

Tool	Runs	What it does
Windows error code lookup	Server	HRESULT, Win32, NTSTATUS, MSI, Windows Update, DISM and Intune codes — with the HRESULT decomposition even for codes not in the dataset

Email

Tool	Runs	What it does
SPF, DKIM and DMARC checker	Server	Whether a domain's mail authentication would actually stop a spoofed message, including the SPF ten-lookup limit

Encoding and Ops

Tool	Runs	What it does
Encoder and decoder	Browser	Base64, base64url, percent-encoding, hex and HTML entities, UTF-8 correct
Cron expression parser	Server	Field-by-field explanation and the next runs in the time zone you pick

---

Add a tool in 15 minutes

This is the part the architecture is built around. Adding a tool touches nothing else — no registration, no route, no core file, no CSS.

./tools/new-tool.ps1 -Name "MAC address lookup" -Category Network

That writes three files in one new folder, and the tool already appears in the gallery and already passes CI. Then you describe the inputs:

[ToolField("MAC address", Placeholder = "00:1A:2B:3C:4D:5E", Required = true, MaxLength = 64)]
public string Address { get; set; } = string.Empty;

…and return structured blocks:

return ToolResult.Build()
    .Status(ResultStatus.Ok, vendor.Name, $"OUI {mac.Oui}")
    .KeyValues("Address", kv => kv
        .Add("Normalised", mac.ToString(), monospace: true)
        .Add("Locally administered", mac.IsLocal ? "yes" : "no"))
    .ToResult();

You never write HTML. The form is generated from the attributes, the results are rendered by the core, and your tool looks exactly like every other one.

→ CONTRIBUTING.md has the full walkthrough. → ARCHITECTURE.md explains how the registry, the form generator and the SSRF guard fit together.

Good first issues

Twenty-five tools are specified and waiting, each with acceptance criteria already written. Comment on one and it is yours.

→ The roadmap — all twenty-five grouped by category, with an effort estimate on each and a shortlist of the five shortest paths from git clone to a merged pull request.

→ Browse the good first issue list — the same set, sorted by GitHub rather than by category.

---

Configuration

Set through appsettings.json or AdminForge__* environment variables.

Setting	Default	What it does
AllowPrivateTargets	false	Lets server-side tools reach private, loopback and link-local addresses. Homelab only — an internet-facing instance with this on is an open proxy into your network.
ToolTimeoutSeconds	15	Budget for a single tool run.
MaxResponseBytes	2097152	Ceiling on any fetched response body.
MaxRedirects	5	Redirects followed, each re-validated.
BlockedHosts	[]	Extra hosts to refuse, including their subdomains and the addresses they resolve to.
TrustedProxies	[]	Reverse proxies (IPs or CIDR ranges) whose X-Forwarded-For is believed. Loopback is always trusted.
InstanceBanner	—	Notice shown on every page, e.g. to mark a public demo.
RateLimit__PermitLimit	30	Tool runs allowed per client, per window.
RateLimit__WindowSeconds	60	Length of that window.

Invalid values fail at startup rather than at the first request. docs/self-hosting.md covers which of these actually matter for a given deployment, and why an instance reachable from a network wants a reverse proxy in front of it.

---

Security

AdminForge holds no accounts and no data, so the interesting surface is narrow — but six of its thirteen tools fetch a target you supply, which is server-side request forgery by design. That is handled once, in the core, and every tool inherits it:

• Private, loopback, link-local (including cloud metadata at 169.254.169.254), carrier-grade NAT and unique-local addresses are refused unless the operator opts in
• A name resolving to a mix of public and private addresses is refused outright — that is a DNS-rebinding vector
• Every redirect hop is re-validated, and the socket refuses a private address even if DNS changes mid-flight
• A strict content security policy with no inline script or style and no third-party origins, and a per-client rate limiter on tool execution

The ranges that are refused, which tool takes which path, what AllowPrivateTargets changes and the limitations that remain are written out in docs/security-model.md; the implementation is in ARCHITECTURE.md. To report a vulnerability, see SECURITY.md.

---

Built with

.NET 10 · ASP.NET Core MVC · DnsClient.NET · Cronos. No front-end framework, no bundler, no node_modules — the browser modules are plain ES modules using platform APIs.

Contributors

Every contributor gets credited here, whatever the contribution — all-contributors counts documentation, bug reports, design and ideas alongside code.

Changelog

Every release is documented in CHANGELOG.md, including the tools currently accepted into the roadmap and open for contribution.

Licence

MIT © Juan Andres Rodriguez

---

If AdminForge saves you a tab, a terminal or an argument with a certificate — ⭐ star it.

That is genuinely how a project like this finds the people who would contribute to it.