MSRXHold your website up to the light.
Paste an address. We look it over the way a bank teller checks a note: certificate, headers, cookies, scripts, mail records and the past year's exploited CVEs. You get a score out of ten, a SWOT of what's strong and what's exposed, and what to fix first.
Passive and read-only, like a single browser visit. Try , , . Scan only sites you own or are allowed to test.
What we hold it against
Every check carries points. The score is points earned out of points available, capped when a critical hole is found so a site with one serious problem can never look “good”.
HTTPS, the HTTP-to-HTTPS redirect, HSTS and preload readiness.
Trust chain, hostname match, days to expiry and protocol version.
CSP quality, clickjacking, MIME sniffing, Referrer, Permissions and COOP.
Secure, HttpOnly and SameSite on every cookie the page sets.
Mixed content, forms over HTTP, scripts without SRI and known-vulnerable libraries.
Version banners in headers and markup, and a security.txt contact.
SPF, DMARC and CAA: can someone spoof your mail or mis-issue a certificate?
Whether other sites can read your responses with a visitor's session.
Fingerprints PHP, WordPress, Next.js, nginx, Apache and 25 more, then matches the last 365 days of CVEs, php2shell and React2Shell included.
13 more instruments
Most run entirely in your browser, so passwords, tokens and code you paste never leave your device.
Websites
Paste a URL. Get a SWOT security report scored out of 10: HTTPS, TLS, headers, cookies, content, DNS and email, with fixes.
○ Runs on our serverExploited vulnerabilities, last 365 daysEvery vulnerability CISA confirmed as exploited in the wild in the past year, live: php2shell, React2Shell, WordPress, SharePoint, Citrix, Fortinet and more. Search and filter.
● Runs in your browserSecurity headers analyserPaste response headers from DevTools or curl -I and get the same header grading as the scanner, for pages we cannot reach.
● Runs in your browserContent Security Policy evaluatorFind the gaps in a CSP: unsafe-inline, wildcards, CDN bypasses, missing object-src, base-uri and frame-ancestors.
● Runs in your browsersecurity.txt generatorWrite an RFC 9116 security.txt so researchers know how to report a vulnerability to you.
Phishing & email
Can anyone send mail as your domain? Reads SPF, DMARC and CAA records and explains each in plain words.
● Runs in your browserSuspicious link inspectorTake a link apart before you click: look-alike letters, punycode, IP hosts, hidden user@ tricks, shorteners and risky TLDs.
Passwords
Estimates how long a password would survive a real cracking attempt, and why. Your password never leaves this page.
● Runs in your browserPassword & passphrase generatorStrong random passwords, PINs and memorable passphrases from your browser's cryptographic random generator.
○ Browser + k-anonymity APIBreached password checkHas this password appeared in a data breach? Uses k-anonymity: only the first 5 characters of its SHA-1 hash are sent.
Developers
SHA-1, SHA-256, SHA-384 and SHA-512 of text or a file, plus checksum verification for downloads.
● Runs in your browserJWT decoder & auditorDecode a JSON Web Token and flag the risky parts: alg none, expired or missing exp, long lifetimes and sensitive claims.
● Runs in your browserLeaked secret finderPaste code, logs or config and find API keys, tokens and private keys before you commit or share them.
● Runs in your browserEncoder & decoderBase64, Base64URL, URL, HTML entities and hex, both ways. Handy for reading suspicious payloads safely.
The ground rules
Passive only
The scanner makes the same few requests a browser makes when it opens your home page. No attack payloads, no crawling, no logins, no form submissions.
Nothing stored
No accounts and no database. A report lives in your browser tab; download it as JSON or save it as a PDF if you want to keep it.
Private by design
Password, JWT, hash and secret tools run in your browser. The breach check sends only the first 5 characters of a hash, never the password.
Honest limits
An outside scan sees one page. It cannot find SQL injection, broken access control or bugs in your code. Treat it as a health check, not a penetration test.