66 free security and developer tools. No signup required.
Verify SSL/TLS certificate details, issuer, expiry date, and certificate chain for any domain.
Also try
Analyze HTTP response headers and check security headers like CSP, HSTS, X-Frame-Options.
Decode JSON Web Tokens to inspect header, payload, and expiration without a secret key.
Analyze password strength with entropy calculation, crack time estimate, and improvement suggestions.
Encode and decode text to and from Base64 format. Fully client-side — your data never leaves the browser.
Generate MD5, SHA-256, and SHA-512 cryptographic hashes from any text input. 100% client-side.
Query DNS records (A, AAAA, MX, TXT, NS, CNAME) for any domain using public DNS API.
Fetch and parse SPF (Sender Policy Framework) records for a domain to validate email security.
Retrieve domain registration details including registrar, registrant, creation date, and expiry.
Fetch, parse, and validate robots.txt. Check which bots are allowed, view sitemaps, test URL paths.
Encode and decode URLs with percent-encoding. Component mode for query params. 100% client-side.
Compute HMAC-SHA256, HMAC-SHA384, HMAC-SHA512. Hex or Base64 output. 100% client-side.
Check Strict-Transport-Security header. Verify max-age, includeSubDomains, preload.
Generate secure random passwords with crypto.getRandomValues. Length 8–64, customizable chars.
AES-256-CBC encryption and decryption. 100% client-side. PBKDF2 key derivation.
Check Access-Control-* headers. Verify Allow-Origin, credentials, methods.
Check X-Frame-Options and CSP frame-ancestors. Detect clickjacking vulnerability.
Verify DKIM DNS records. Domain + selector → TXT lookup and parse.
Verify DMARC DNS records. Policy, RUA, RUF, alignment.
Convert text to hex and hex to text. UTF-8. 100% client-side.
Validate, format, minify JSON. Error location. 100% client-side.
Convert Unix epoch to date and date to timestamp. Seconds or milliseconds.
Check Content-Security-Policy. Parse directives, detect unsafe-inline, unsafe-eval.
Check if TCP ports are open. Host + ports → connect test.
Generate UUID v4 (random). RFC 4122. 100% client-side.
Test regular expressions. Matches, capture groups, replace. JavaScript.
Generate placeholder text. Paragraphs or words. Plain or HTML.
Encode &, <, > to HTML entities. Decode back. Prevent XSS.
Validate cron expressions. Format: min hour day month weekday.
Find HTTP resources on HTTPS pages. Paste HTML, scan scripts, images, styles.
Generate RSA 1024/2048/4096 bit keys. PEM format. 100% client-side.
Analyze URL for open redirect risks. Check redirect params.
Parse Set-Cookie headers. Check HttpOnly, Secure, SameSite.
Check if URL exposes directory listing. Index of, file list.
Parse URL into protocol, host, path, query params. 100% client-side.
Parse User-Agent string. Browser, OS, device, bot. 100% client-side.
Quick one-off URL check. HTTP status + response time.
Check mail server (MX) records. Priority order.
Validate IPv4/IPv6. Private, loopback. 100% client-side.
Text to binary and binary to text. 100% client-side.
Generate QR code from text or URL. Download PNG. 100% client-side.
Escape or unescape JS string literals. 100% client-side.
IPv4 subnet calculator. Network, broadcast, host range.
Detect hash type by length/format. MD5, SHA1, SHA256, bcrypt.
UPPERCASE, lowercase, Title Case, Sentence case.
Trim, collapse spaces, remove whitespace.
Discover subdomains via Certificate Transparency logs. Passive enumeration — no brute force.
Detect what technologies power a website — CMS, frameworks, CDN, analytics from headers and HTML.
Check when a domain was registered. Domain age, creation date, expiry, registrar — from WHOIS.
Verify Stripe and GitHub webhook signatures. HMAC-SHA256. 100% client-side — secret never leaves browser.
Detect Cloudflare, Akamai, AWS WAF, Sucuri, Fastly. Passive header analysis — no attack payloads.
Follow 301/302/307/308 redirects. See every hop with status and latency. SEO & security.
Detect homograph attacks — Cyrillic/Greek lookalikes in domains. Phishing prevention. 100% client-side.
Convert IDN domains to ASCII (xn--) and back. Internationalized domain names. Free online.
Generate secure random API keys. Hex or URL-safe Base64. 100% client-side.
Minify JSON — remove whitespace. Validate and compress. 100% client-side.
Validate email format and check MX records. Verify if domain accepts mail.
Look up PTR hostname for an IP. Reverse DNS for IPv4/IPv6. Like HackerTarget.
IP to location, ISP, ASN. Country, city, timezone. Free geolocation.
Check Certificate Authority Authorization. Restrict which CAs can issue SSL certs.
Check Referrer-Policy header. Control referrer info. Privacy & security. Like Barrion.
Get A+ to F grade for HTTP security headers. Like SecurityHeaders.com.
Check Permissions-Policy header. Restrict geolocation, camera, microphone.
Check if site redirects HTTP to HTTPS. Redirect chain. HSTS preload requirement.
Detect Server, X-Powered-By headers leaking tech versions. Barrion competitor.
Check X-Content-Type-Options: nosniff. Prevent MIME sniffing.