Web security
Browser-side defense, audited the way an assessor would.
Eighteen scanners and utilities across transport, browser hardening, URL handling, DNS, tokens, and data — the configurations and primitives that stop clickjacking, XSS, and downgrade attacks, plus the everyday inspectors security engineers reach for daily.
Transport
How the page gets to the browser — certificates and mixed assets.
TLS certificate scan
PaidReal TLS handshake — chain trust, expiry, negotiated version, public-key strength, and signature algorithm.
Open tool →Mixed-content scanner
PaidWalks an https page for http:// sub-resources. Distinguishes active (blocked) from passive (warned) mixed content.
Open tool →Browser hardening
What the browser is told to enforce — headers and cookie flags that stop XSS and clickjacking.
HTTP security headers
PaidGrades CSP, HSTS, frame protection, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy. Weighted scoring with a fix list.
Open tool →Security headers builder
FreePick your CSP directives, frame policy, referrer-policy, and Permissions-Policy. We emit a ready-to-paste header block for your CDN or reverse proxy.
Open tool →CSP analyzer
FreePaste your Content-Security-Policy header. We grade every directive against modern best practice — wildcards, 'unsafe-inline', missing frame-ancestors, and the rest.
Open tool →CORS policy analyzer
FreePaste your Access-Control-* headers. Catches wildcard + credentials (browser refuses), Allow-Origin: null (exploitable), and comma-separated origin lists.
Open tool →HSTS preload checker
FreePaste your Strict-Transport-Security header. We grade it against Chrome's preload-list requirements (max-age >= 1y, includeSubDomains, preload).
Open tool →Cookie security audit
PaidPer-cookie grading of Secure, HttpOnly, and SameSite — the three flags that decide whether XSS can steal sessions.
Open tool →Cookie parser
FreePaste a single Set-Cookie line. Decomposes name/value/attributes and grades against modern best practice (Secure, HttpOnly, SameSite, __Host-, Partitioned).
Open tool →URL handling
How your site follows links — open-redirect phishing primitives.
Open-redirect detector
PaidProbes redirect-shaped query parameters with an attacker-controlled destination. Fails are endpoints with no allowlist.
Open tool →URL inspector
FreeDecomposes a URL into scheme, host, path, query, fragment. Flags safety findings — IDN homograph attacks, suspicious ports, mismatched encoding.
Open tool →DNS hardening
DNS records that protect your cert issuance and security disclosure path.
DNS map
FreeOne-shot reconnaissance scan. Pulls NS/MX/A/AAAA/TXT/CAA on the apex, discovers subdomains via Certificate Transparency, resolves the owning ASN per IP, and renders the whole thing as a node-link map.
Open tool →CAA record builder
FreePick the CAs you trust. Emits the DNS CAA records to publish so unauthorized CAs can't issue certs for your domain.
Open tool →security.txt builder
FreeGenerate a valid /.well-known/security.txt (RFC 9116). Warns on http://, expired, or 2+ year-out Expires fields.
Open tool →Tokens & encoding
Inspect, decode, and verify the tokens, encodings, and identifiers your app uses every day.
JWT inspector
FreeDecode header + payload, flag the `alg: none` exploit, show expiry status, and list claim sets. Doesn't verify signatures — that requires the secret.
Open tool →Hash calculator
FreeMD5, SHA-1, SHA-256, SHA-384, SHA-512. Paste text or upload a file; copy any digest with one click.
Open tool →Base64 encoder / decoder
FreeEncode arbitrary bytes to base64 or base64url; decode the other way. Useful for inspecting auth headers and CSP nonces.
Open tool →URL encoder / decoder
FreePercent-encode or decode in three flavors — encodeURI, encodeURIComponent, and form-urlencoded (+ for space).
Open tool →HTML entity encoder / decoder
FreeEscape the five OWASP-mandated characters (or every non-ASCII). Decode named, decimal, and hex references. Detects double-encoding.
Open tool →UUID inspector + v4 generator
FreeGenerate v4 UUIDs in bulk; inspect a UUID's variant + version. Useful when correlating logs across services.
Open tool →Password strength checker
FreeEntropy + time-to-crack against three attacker baselines. 100% client-side — your password never leaves the browser. Flags repeated chars, year suffixes, top-100 breach corpus.
Open tool →Timestamp converter
FreeConvert between Unix epoch (seconds/ms), ISO-8601, RFC 3339, and human-readable. Always uses UTC to avoid timezone confusion.
Open tool →Cron expression explainer
FreePaste a 5-field cron expression — we explain it in plain English and show the next 6 UTC fire times. Catches the dom/dow OR-semantics gotcha.
Open tool →Data tools
Format, validate, and test the data shapes your security tooling pumps around.
IPv4 CIDR calculator
FreeCompute network/broadcast, usable range, mask, and host count for any IPv4 CIDR. Handy when carving subnets for new VPCs.
Open tool →IPv6 address inspector
FreeExpand ::-compressed addresses to full 8-hextet form, get the RFC 5952 canonical form, classify scope, derive reverse-DNS PTR.
Open tool →JSON formatter / minifier / validator
FreePretty-print, minify, or validate any JSON. Surfaces parse errors with line + column. Stays entirely client-side.
Open tool →Regex tester
FreeLive regex match preview against multi-line input. Highlights matches + groups. JavaScript regex flavor; no PCRE-only features.
Open tool →Text diff viewer
FreeCompare two texts line-by-line. Side-by-side or unified view, with +/- stats. Useful for comparing two CSP headers, JSON payloads, or config files.
Open tool →