Security tools
50 focused diagnostics across four categories. Choose a topic and subcategory, or search the complete collection below.
Browser fingerprint
Read your browser’s exposed signals. Compare sessions with an exportable fingerprint report.
WebRTC exposure test
Inspect ICE candidates and check whether WebRTC exposes an unexpected connection address.
Canvas fingerprint
Render a controlled canvas, hash the pixels and compare repeatability across two runs.
WebGL inspector
Inspect the GPU renderer, extensions and graphics limits visible to a website.
Audio fingerprint
Process a silent offline audio graph and compare its numerical output across repeated runs.
Browser permissions audit
Read site permission states, privacy signals and relevant browser capabilities.
Public IP & connection
Find the public IP seen by an external service and inspect your connection’s browser signals.
DNS record explorer
Query A, AAAA, MX, TXT, CAA and other DNS records with TTLs and resolver status.
DNSSEC inspector
Read a validating resolver’s AD flag and inspect DS, DNSKEY and signed answer records.
Email domain security
Inspect MX, SPF, DMARC and a chosen DKIM selector with configuration-specific findings.
TLS certificate inspector
Inspect a live TLS handshake: certificate chain, expiry, hostname match, protocol and cipher.
HTTP security headers
Inspect a live response for HSTS, CSP, framing rules and other browser security policies.
Content Security Policy audit
Parse a pasted CSP, inspect effective fallbacks and identify permissive script policies.
Cookie security audit
Check pasted Set-Cookie headers for Secure, HttpOnly, SameSite and cookie prefix rules.
Suspicious URL inspector
Reveal misleading authority, punycode, tracking parameters and encoded URL components.
JWT inspector & verifier
Decode token claims and verify HS256 or RS256 signatures using a key you supply.
File integrity verifier
Compute SHA-256, SHA-384 or SHA-512 for a file and compare an expected checksum.
Encrypted file vault
Encrypt or decrypt a file using AES-256-GCM with a password-derived key and authenticated metadata.
Password breach check
Check the Pwned Passwords corpus using a five-character hash prefix, not your password.
HAR privacy auditor
Inspect a network archive for third-party hosts, credential-shaped fields and insecure requests.
Screen & viewport inspector
Measure screen size, layout and visual viewports, pixel ratio and orientation in this tab.
Browser capability checker
Check whether common browser APIs are exposed, including Web Crypto, WebAssembly, WebGPU and workers.
Origin storage inspector
Read this origin’s storage estimate, quota and persistence status without opening stored records.
Media codec support checker
Inspect advertised support for common video and audio formats without recording or playing media.
Language & timezone inspector
Inspect browser languages, timezone, calendar and number-format settings with local formatting examples.
Privacy & display preferences
Read exposed privacy preferences, reduced motion, contrast, forced colors and the preferred color scheme.
IPv4 subnet calculator
Calculate an IPv4 CIDR network, mask, broadcast address and usable host range.
IPv6 address inspector
Expand and compress an IPv6 address and identify common address scopes.
Domain name inspector
Inspect ASCII domain labels, IDN conversion and hostname length without performing a DNS lookup.
SPF policy analyser
Parse a pasted SPF policy, identify qualifiers and count direct DNS-using terms.
DMARC policy analyser
Read a pasted DMARC record and review policy, alignment, reporting and percentage tags.
DKIM public key inspector
Inspect a pasted DKIM key record, its key type, flags and public-key size.
CAA record analyser
Inspect CAA flags, issuer authorisations and reporting properties from pasted record values.
DNS TTL calculator
Convert a TTL in seconds to readable units and an illustrative cache expiry time.
HSTS policy analyser
Parse Strict-Transport-Security and inspect max-age, includeSubDomains and preload intent.
Referrer-Policy analyser
Identify the effective recognised Referrer-Policy token and explain its cross-origin behavior.
Permissions-Policy analyser
Read feature allowlists from a pasted Permissions-Policy response header.
CORS header analyser
Inspect pasted Access-Control response headers for wildcard, credential and cache pitfalls.
Subresource integrity generator
Create a SHA-256, SHA-384 or SHA-512 integrity token from a local JavaScript or CSS file.
URL component encoder
Encode or decode a UTF-8 URL component with strict percent-escape validation.
security.txt validator
Review pasted security.txt fields, expiry and disclosure contact information.
Text hash calculator
Compute SHA-256, SHA-384 or SHA-512 over the exact UTF-8 bytes of your text.
HMAC generator
Calculate an HMAC over exact UTF-8 text using a secret key and a SHA-2 algorithm.
Base64 text encoder
Encode UTF-8 text to Base64 or decode Base64 back to valid UTF-8 text.
Hexadecimal text encoder
Convert UTF-8 text to hexadecimal bytes and decode valid hexadecimal back to text.
JSON validator & formatter
Validate a JSON document, inspect its structure and download a consistently formatted copy.
UUID v4 generator
Generate random version-4 UUIDs with the browser’s cryptographic random source.
Secure password generator
Generate a password with cryptographic randomness and a selectable character set.
Random token generator
Generate cryptographically random bytes and encode them as hexadecimal or unpadded Base64url.
Timestamp converter
Convert Unix seconds, Unix milliseconds or a strict ISO timestamp into UTC and local time.
No tools found.
Try another search or category.