WAF Rule Lookup

Cloudflare's WAF logs only show a Rule UUID when it blocks something. Search the OWASP CRS ruleset by ID, or upload a security event to find out why — and decrypt the matched payload right here, without sending your key anywhere.

Search the ruleset

Upload a security event

Export a blocked request's security event as JSON from the Cloudflare dashboard. We'll match its rules automatically. If it has an encrypted payload, add your payload log private key to decrypt it.

Your file and private key never leave this tab

The event is parsed and its payload decrypted on your device. Nothing you upload or type here is sent to OriginError or anyone else.

How this works

Decryption is HPKE (X25519, HKDF-SHA256, ChaCha20-Poly1305), the scheme Cloudflare's payload logging uses. It runs in a version-pinned copy of the hpke-js library served from this site, not a third-party CDN.
The private key is read once per Analyze and the field is cleared afterwards. It isn't stored in the page, the URL or browser storage.
Besides loading itself (its scripts and fonts, all served from this site), the page makes one network request: downloading the rule dataset from originerror.com. None of them carry your file or key.
"Copy for Claude" only copies a prompt to your clipboard. Values that look like credentials or personal data (tokens, keys, emails, card numbers) are masked first, but read the prompt before you paste it anywhere: once pasted, it's handled by that service.

Security event JSON

Payload log private key (optional)

Read in your browser, used once, then cleared from this field after every Analyze. It is never sent anywhere. Where to find this key

Search, upload parsing and decryption all run in your browser. Nothing you upload or type is sent to OriginError's servers.