The toolkit

14 free security tools

Tools marked with a green dot run entirely in your browser: what you paste never leaves your device.

Websites

○ Runs on our serverWebsite vulnerability scanner

Paste a URL. Get a SWOT security report scored out of 10: HTTPS, TLS, headers, cookies, content, DNS and email, with fixes.

○ Runs on our serverExploited vulnerabilities, last 365 days

Every vulnerability CISA confirmed as exploited in the wild in the past year, live: php2shell, React2Shell, WordPress, SharePoint, Citrix, Fortinet and more. Search and filter.

● Runs in your browserSecurity headers analyser

Paste response headers from DevTools or curl -I and get the same header grading as the scanner, for pages we cannot reach.

● Runs in your browserContent Security Policy evaluator

Find the gaps in a CSP: unsafe-inline, wildcards, CDN bypasses, missing object-src, base-uri and frame-ancestors.

● Runs in your browsersecurity.txt generator

Write an RFC 9116 security.txt so researchers know how to report a vulnerability to you.

Phishing & email

○ Runs on our serverEmail spoofing check (SPF, DMARC, CAA)

Can anyone send mail as your domain? Reads SPF, DMARC and CAA records and explains each in plain words.

● Runs in your browserSuspicious link inspector

Take a link apart before you click: look-alike letters, punycode, IP hosts, hidden user@ tricks, shorteners and risky TLDs.

Passwords

● Runs in your browserPassword strength checker

Estimates how long a password would survive a real cracking attempt, and why. Your password never leaves this page.

● Runs in your browserPassword & passphrase generator

Strong random passwords, PINs and memorable passphrases from your browser's cryptographic random generator.

○ Browser + k-anonymity APIBreached password check

Has this password appeared in a data breach? Uses k-anonymity: only the first 5 characters of its SHA-1 hash are sent.

Developers

● Runs in your browserHash & checksum generator

SHA-1, SHA-256, SHA-384 and SHA-512 of text or a file, plus checksum verification for downloads.

● Runs in your browserJWT decoder & auditor

Decode a JSON Web Token and flag the risky parts: alg none, expired or missing exp, long lifetimes and sensitive claims.

● Runs in your browserLeaked secret finder

Paste code, logs or config and find API keys, tokens and private keys before you commit or share them.

● Runs in your browserEncoder & decoder

Base64, Base64URL, URL, HTML entities and hex, both ways. Handy for reading suspicious payloads safely.