Free tools
Free Security Tools
Small utilities for the moment you need one during a test or a review. No account and no tracking, and the work happens in your browser.
Every tool page says what it sends over the network and what it stores. Three of the four are No network: nothing you enter leaves the tab. The DNS tool sends queries to one public resolver, and its page names the host and what goes to it.
Tools
-
JWT Decoder
Decode a token, read its expiry as a date, and catch alg none, algorithm confusion, missing exp and long lifetimes.
No network
-
CSP Evaluator
Parse a Content-Security-Policy and see which directives leave script injection open, with the fix for each.
No network
-
Security Headers Check
Paste response headers from curl or devtools and get HSTS, CSP, framing, cookies and caching graded.
No network
-
DNS and Email Records
Read SPF, DMARC, DKIM, MX, CAA and A records the way a tester does, from a public DNS over HTTPS resolver.
Queries sent to the resolver
How they are built
Each tool is one plain script written for this site and served from it, with no third-party code, no cookies and no analytics. Results come with what they mean and what to change, because a finding nobody can act on helps no one. If one of them gets something wrong, the disclosure page says how to tell us.