Paste the JSON output of gcloud projects get-iam-policy --format=json (or any GCP IAM policy with a bindings array) to see who has which roles, in plain English, with overly broad grants flagged. Nothing is ever uploaded.
Bindings
How it works
Paste the bindings array from a GCP IAM policy and the tool looks up each role against a built-in glossary of common predefined GCP roles to show a plain-English description, then flags any binding granted to allUsers or allAuthenticatedUsers, or whose role is marked broad (like Owner or Editor) in its glossary entry — all parsed and matched locally in your browser.
FAQ
What if my policy uses a role that's not in the built-in glossary, like a custom role?
It falls back to a pattern-based guess — .admin roles are labeled as broad service-admin access, .viewer/.reader roles as read-only, and custom roles are flagged for manual review since their exact permissions can't be inferred from the name alone.
What's the difference between the public-access warning and the broad-role warning?
The public-access warning (red) triggers when a binding's members include allUsers or allAuthenticatedUsers, meaning anyone on the internet or with any Google account has that role; the broad-role warning (amber) triggers on the role itself, like Owner or Editor, regardless of who it's granted to.
Free, unlimited, no account. If this saved you a paid tool, a small thanks is appreciated.