MSRXHold your website up to the light.
Paste an address. We look it over the way a bank teller checks a note: certificate, headers, cookies, scripts, mail records and the past year's exploited CVEs. You get a score out of ten, a SWOT of what's strong and what's exposed, and what to fix first.
Passive and read-only, like a single browser visit. Try , , . Scan only sites you own or are allowed to test.
What we hold it against
Every check carries points. The score is points earned out of points available, capped when a critical hole is found so a site with one serious problem can never look “good”.
HTTPS, the HTTP-to-HTTPS redirect, HSTS and preload readiness.
Trust chain, hostname match, days to expiry and protocol version.
CSP quality, clickjacking, MIME sniffing, Referrer, Permissions and COOP.
Secure, HttpOnly and SameSite on every cookie the page sets.
Mixed content, forms over HTTP, scripts without SRI and known-vulnerable libraries.
Version banners in headers and markup, and a security.txt contact.
SPF, DMARC and CAA: can someone spoof your mail or mis-issue a certificate?
Whether other sites can read your responses with a visitor's session.
Fingerprints PHP, WordPress, Next.js, nginx, Apache and 25 more, then matches the last 365 days of CVEs, php2shell and React2Shell included.
34 more instruments
Most run entirely in your browser, so passwords, tokens and code you paste never leave your device.
Websites
Paste a URL. Get a SWOT security report scored out of 10: HTTPS, TLS, headers, cookies, content, DNS and email, with fixes.
○ Runs on our serverBulk website scannerPaste up to 25 domains and get one table of scores, grades and the first fix for each, worst first, with a CSV to download.
○ Runs on our serverSubdomain finder & takeover checkFind every subdomain in public certificate logs and flag DNS records that point at deleted cloud resources, which anyone could claim.
● Runs in your browserSecurity headers analyserPaste response headers from DevTools or curl -I and get the same header grading as the scanner, for pages we cannot reach.
● Runs in your browserContent Security Policy evaluatorFind the gaps in a CSP: unsafe-inline, wildcards, CDN bypasses, missing object-src, base-uri and frame-ancestors.
● Runs in your browsersecurity.txt generatorWrite an RFC 9116 security.txt so researchers know how to report a vulnerability to you.
Vulnerabilities
Every vulnerability CISA confirmed as exploited in the wild in the past year, live: php2shell, React2Shell, WordPress, SharePoint, Citrix, Fortinet and more. Search and filter.
○ Browser + public APIIs my software being exploited?List the software you run and see which vulnerabilities attackers exploited in the past year. Optional e-mail alert the day a new one matches.
○ Browser + public APIDependency vulnerability scannerDrop in a lockfile (npm, yarn, pnpm, pip, Poetry, uv, Go, Cargo, Ruby, Composer, Maven, NuGet) and see every package with a known vulnerability, what is being exploited, and the version that fixes it.
○ Runs on our serverCVE lookupEverything about one CVE on one page: description, CVSS scores, exploitation in the wild (CISA KEV), EPSS probability, affected products and fixed package versions. Or search a product for its newest CVEs.
● Runs in your browserCVSS 4.0 and 3.1 calculatorScore a vulnerability with CVSS 4.0 or 3.1, explained in plain words, or paste a vector to see what it means.
Phishing & email
Paste a suspicious email's headers: see who really sent it, whether SPF, DKIM and DMARC passed, the relay path, and the spoofing tells.
○ Runs on our serverEmail spoofing check (SPF, DMARC, CAA)Can anyone send mail as your domain? Reads SPF, DMARC and CAA records and explains each in plain words.
○ Browser + public APIScam message checkerPaste an SMS, WhatsApp message, email or call script. It checks for the scripts used in India (fake KYC, “digital arrest”, UPI refunds, task jobs) and can ask Jev for an AI second opinion.
● Runs in your browserPhishing e-mail checkerPaste a whole suspicious e-mail or drop an .eml: who really sent it, what the words ask for, where every link goes (even when the text lies), and what the attachments are.
● Runs in your browserQR code checkerRead a QR code from a screenshot or photo and see what it really does before you scan: UPI payments that send money, look-alike links, app installs, Wi-Fi and 2FA secrets.
● Runs in your browserSuspicious link inspectorTake a link apart before you click: look-alike letters, punycode, IP hosts, hidden user@ tricks, shorteners and risky TLDs.
● Runs in your browserScam and phishing awareness quizTwelve real scam situations from India, in English and Hindi: OTP calls, digital arrest, QR payments, fake APKs, task jobs and invoice fraud. Score yourself and print a certificate.
● Runs in your browserOfficial website and helpline checker (India)Is this link, number or UPI ID really your bank, the tax department or Aadhaar? Paste it, or the whole message, and see the real address and helpline, and whether it is a look-alike.
● Runs in your browserSecure your family checklistUPI habits, WhatsApp and Google lockdown, Aadhaar biometric lock, SIM check and the digital-arrest rule, with extra steps for parents and children. English and Hindi.
Incident response
Paste nginx or Apache access logs and find SQL injection, XSS, path traversal, Log4Shell, secret probing, scanners and login brute force, by IP.
● Runs in your browserIOC extractor & defangerPull IPs, domains, URLs, emails, hashes and CVE IDs out of any report or alert, defanged and ready to share or block.
● Runs in your browserSuspicious file checkerDrop a file you were sent: see what it really is, whether the name lies, and whether it carries macros, PDF scripts, shortcuts or Android banking-trojan permissions. Plus its SHA-256.
○ Browser + public APIBreach reporting deadlines (India)Do you have to report a breach, to whom, and by when? CERT-In's 6-hour rule and the DPDP Rules' Board and 72-hour duties, with a draft report e-mail.
● Runs in your browserReport a fraud (India)Lost money to a UPI or bank scam, a fraud call, a lost phone or a hacked account? Who to contact in what order, plus a ready complaint text for 1930, cybercrime.gov.in and your bank.
● Runs in your browserSmall business security kitFill in a few fields and get an incident response plan, a one-page security policy, a vendor security questionnaire and a DPDP privacy notice, ready to edit.
● Runs in your browserFraud evidence pack builderBuild one dated sheet for a fraud complaint: timeline, every transaction with its UTR, the fraudster's numbers and IDs, who you told, and what is still missing. Print or save as PDF.
Passwords
Estimates how long a password would survive a real cracking attempt, and why. Your password never leaves this page.
● Runs in your browserPassword & passphrase generatorStrong random passwords, PINs and memorable passphrases from your browser's cryptographic random generator.
○ Browser + public APIBreached password checkHas this password appeared in a data breach? Uses k-anonymity: only the first 5 characters of its SHA-1 hash are sent.
Developers
Paste a GitHub Actions workflow, Dockerfile, Kubernetes manifest or Compose file and find pwn requests, script injection, unpinned actions, root containers and leaked secrets.
● Runs in your browserHash & checksum generatorSHA-1, SHA-256, SHA-384 and SHA-512 of text or a file, plus checksum verification for downloads.
● Runs in your browserJWT decoder & auditorDecode a JSON Web Token and flag the risky parts: alg none, expired or missing exp, long lifetimes and sensitive claims.
● Runs in your browserLeaked secret finderPaste code, logs or config and find API keys, tokens and private keys before you commit or share them.
● Runs in your browserEncoder & decoderBase64, Base64URL, URL, HTML entities and hex, both ways. Handy for reading suspicious payloads safely.
Something went wrong
Hacked, phished, scammed or locked out. Describe it in your own words and get the right steps, in order. In India, if money has left your account, call 1930 first.
The ground rules
Passive only
The scanner makes the same few requests a browser makes when it opens your home page. No attack payloads, no crawling, no logins, no form submissions.
Nothing stored by default
No accounts. A scan or a tool keeps nothing: the report lives in your browser tab. Only if you choose weekly monitoring do we keep your e-mail and results, until you delete them.
Private by design
Password, JWT, hash and secret tools run in your browser. The breach check sends only the first 5 characters of a hash, never the password.
Honest limits
An outside scan sees one page. It cannot find SQL injection, broken access control or bugs in your code. Treat it as a health check, not a penetration test.