Free. No signup. Nothing is uploaded.

Free tools for report work

Small things that take a job you do by hand and do it in a few seconds. Both of these run entirely in your browser: there is no account, no upload, and no copy kept anywhere. Open the network tab and check, which is the point of building them this way.

Runs in your browser Emits a DOCX

IOC and timeline appendix builder

Paste indicators and timeline lines exactly as they came out of your notes: defanged, duplicated, out of order, whatever shape they are in. Get back two formatted appendix tables in a Word document you can drop into a report.

  • Reads Markdown tables, bulleted lists and labelled fields
  • Classifies each indicator and groups by type
  • Anything it cannot classify goes under Other rather than being dropped
  • The output file carries no Benchnotes branding, because it goes into your deliverable
Open the appendix builder
Runs in your browser 99 tests

Case notes sanitizer

Paste a shift's notes and get back a version with the client stripped out. Hostnames, addresses, accounts, shares, case numbers and people are replaced with stable pseudonyms, so HOST-01 is still the same machine on line 4 and on line 240 and the timeline still reads as a timeline.

  • Timestamps and hashes are never touched
  • Public indicators are kept by default, so the attacker address stays pivotable
  • It proposes the client's own name back to you from what it already matched
  • Every replacement is listed for review before you export anything
Open the sanitizer

Why they make no network requests

Both pages are aimed at people who will open devtools to check, so neither loads a webfont, an analytics script or a font from a third party, and neither sends your input anywhere. That is why they look plainer than the rest of this site. Once a page has loaded you can turn the wifi off and it still works, and I recommend trying exactly that before you paste anything real into either of them.

What these are not

Neither tool makes a judgment call for you. The appendix builder formats what you give it, and the sanitizer does a first pass at removing identifying detail. The sanitizer in particular is not a guarantee. It finds things shaped like a hostname or an address; it cannot find a client named only in the middle of a sentence unless you tell it the name. Read the output before you send it anywhere.

I am a developer, not an incident responder. These were built by reading published incident reports and the shapes they print, not from case work. That is a real limit: they know the shapes those reports use and nothing else. Where one of them meets your notes and gets it wrong, hello@benchnotes.io reaches a person rather than a queue.

What is next

There is a short study running on how incident reports actually get written, at benchnotes.io/survey. It takes about six minutes, there is no pricing question in it, and the results get posted publicly. If you want the next tool to be the one you actually need, that is where to say so.