Privacy

Last updated 29 October 2026

MSRX Security is run by Mrinal Singh Raja, an individual, under the brand MSRX. There are no accounts, no database, no cookies, no analytics and no advertising.

Tools that run in your browser

The headers analyser, CSP evaluator, link inspector, password strength checker, password generator, hash generator, JWT decoder, secret finder, encoder and security.txt generator work entirely on your device. What you type or paste into them, and any file you hash, is never sent to us or anyone else.

Breached password check

Your password is hashed with SHA-1 in your browser. Only the first 5 of the hash's 40 characters are sent, directly from your browser, to the Have I Been Pwned Pwned Passwords service (api.pwnedpasswords.com, operated by Troy Hunt and served through Cloudflare). The response lists hundreds of hashes; the comparison happens on your device. Neither we nor that service learn your password.

Website scanner and email spoofing check

The address or domain you enter is sent to our server, which makes the requests and DNS lookups described on the How it works page and returns the report to your browser. We do not store the address or the report. To enforce rate limits, your IP address and the scanned address are held in server memory for up to 10 minutes and then discarded; they are not written to any database or file by us.

The site you scan will see requests from our hosting provider's IP addresses, not yours, identified by the user agent MSRX-SecurityScanner.

Hosting

The site is hosted on Vercel. Like any web host, Vercel processes your IP address and request details to deliver pages and may keep short-lived operational logs under its own privacy policy.

Contact

Questions or requests: mrinalsinghraja@gmail.com. Grievance contact for India: the same address.