Free security, network & developer tools

Run focused website security checks and browser-based developer tools, free with no signup. Search by tool name or task. For a broader review, try the free web scan or the performance test.

New
EXIF & file metadata viewerInspect GPS, camera, document and other file metadata in your browser. Files stay on your device. Post-quantum TLS readinessCheck whether HTTPS negotiates hybrid ML-KEM key exchange and whether the server selects it. Dependency vulnerability checkerUpload package-lock.json, composer.lock, requirements.txt… — known CVEs per package and the fixed version. Password breach checker & generatorCheck a password against known breaches with a k-anonymity lookup, or generate a strong password locally. Your full password stays in your browser. Secret & API key scannerFind leaked API keys, tokens, private keys and credentials in code, config or JS bundles. Runs entirely in your browser; nothing is uploaded. Container security scanPublic Docker image CVEs, or Dockerfile / Kubernetes / Terraform misconfigurations and secrets. Powered by Trivy. Automatic web application CVE checkerPassively check a public website for disclosed supported versions and matching NVD CVEs. Not an exploit scan. Software & language version CVE checkerCheck up to five supported software or language versions for known CVEs. Review severity, affected ranges and available NVD fix guidance.
Web & TLS
Security headers analyzerGrade CSP, HSTS, X-Frame-Options and the rest, A+ to F. CSP evaluatorReview enforced Content-Security-Policy for risky sources and missing hardening directives. CORS policy checkerInspect cross-origin headers and preflight behavior for wildcard, reflected-origin and credential risks. Cookie security checkerReview Secure, HttpOnly and SameSite attributes without showing cookie values. Cache-Control checkerInspect browser and shared-cache directives, validators and common policy conflicts. Robots.txt & sitemap validatorCheck crawler directives, sitemap reachability, XML markers and listed URL counts. TLS / SSL checkerCertificate, chain, expiry, protocol support (SSLv3–TLS 1.3), HSTS, grade. HTTP header checkerEvery response header verbatim, status, HTTP version and timing. Redirect chain tracerFollow every hop: status, Location, host and scheme changes, loops. CSR / certificate decoderPaste a PEM CSR or cert — subject, SAN, key, signature. Nothing leaves your browser round-trip.
DNS & domain
DNS records lookupA, AAAA, MX, NS, TXT, CAA, SOA, PTR and DNSSEC in one view. DNS propagation checkerCompare A, AAAA, MX and NS answers across Cloudflare, Google and Quad9 resolvers. security.txt checkerFind a vulnerability disclosure file and check its key RFC 9116 fields and expiry. WHOIS / domain ageRegistrar, creation and expiry dates, nameservers, status — via RDAP. Blacklist & reputationSpamhaus, SURBL, URIBL, Barracuda and the Quad9 threat resolver.
Email security
SPF / DKIM / DMARC checkerFull email-auth posture: SPF, DKIM, DMARC policy, MTA-STS, TLS-RPT, BIMI, MX. Email header analyzerPaste raw headers — delivery path, hop delays, SPF/DKIM/DMARC results, spoof signals.
Developer & SRE
JSON formatter & validatorValidate JSON, pretty-print it, or minify it locally in your browser. Hash & checksum generatorCalculate SHA-256, SHA-384 or SHA-512 for text and files, locally. URL encoder / decoderEncode or decode URL components and full URLs locally in your browser. Base64 & image converterEncode/decode text and convert images to or from Base64 data URLs, locally. JWT decoderDecode header and claims, check exp/nbf, optionally verify HS256. Runs in your browser. HAR viewer & sanitizerDrop a .har file — waterfall and request table; strip cookies and auth before sharing. Web server log analyzer & advisorTurn Apache, Nginx and JSON logs into a traffic dashboard, then get prioritised capacity, caching, reliability and hardening recommendations. Runs locally. Error log analyzerCollapse Apache, Nginx and PHP error logs into recurring fault signatures, classified by root cause, with code hotspots. Runs locally. SSH & auth log analyzerFind brute force sources that later succeeded, root logins, sudo escalation and account changes in auth.log. Runs locally. Slow query log analyzerFingerprint MySQL and Postgres slow queries, rank by total time, and spot missing indexes from the rows-examined ratio. Runs locally. Load balancer & CDN log analyzerTrue p50/p95/p99 latency, cache hit ratio and balancer-vs-app error attribution from ALB, CloudFront and Cloudflare logs. iftop outgoing traffic analyzerReview peer IPs and transfer rates from iftop output, flag unusual outbound volume for investigation, and learn what the sample cannot prove. Runs locally. WebTrafficIQ — all log analyzersThe full set of log analyzers in one place, with guidance on which log answers which question. SLA & error-budget calculatorUptime % ↔ allowed downtime, and how much error budget a period gives you. Browser fingerprint testSee the entropy a site can read from your browser without cookies.

These are automated heuristics for triage, not a verdict on any site or its operator. Use them only against systems you are authorized to test. See the Disclaimer, Privacy Policy and Terms.