Security tools
These tools check a site or domain's server-side exposure: SSL/TLS certificates, security headers, DNS configuration, cookies, and password strength. Every scan runs on demand, with no signup and no data kept beyond the session.
Sitemap Validator
Fetch and validate a domain's sitemap.xml structure, then spot-check a sample of listed URLs for reachability. Free, instant.
SEOStructured Data Validator
Validate a page's JSON-LD structured data: correct syntax, and required fields for common schema.org types. Free, instant.
SEOSEO Meta Tag Analyzer
Audit a page's title, meta description, canonical link, and Open Graph/Twitter tags against SEO best practices. Free, instant.
SEOFavicon & Manifest Checker
Check whether a site serves a favicon, an Apple touch icon, and a valid web app manifest. Free, instant site health check.
HeadersEmail Verifier
Verify an email address syntax and confirm its domain can receive mail via MX records. Free, instant — not an SMTP mailbox check.
EmailPassword Breach Checker
Check if your password has appeared in a known data breach, using Have I Been Pwned k-anonymity. Your password never leaves your browser.
PasswordsBlacklist Checker
Check if a domain's IP is listed on well-known spam blacklists (DNSBL). Free, instant — not exhaustive or authoritative.
DomainCORS Policy Checker
Test a site's CORS configuration for overly permissive or credential-leaking cross-origin access — free, instant, no signup.
HeadersCSP Analyzer
Get a directive-by-directive breakdown of a site's Content-Security-Policy: what's missing, what's weak, and how to fix it. Free.
HeadersHTTP/2 & HTTP/3 Support Checker
Check whether a domain negotiates HTTP/2 and advertises HTTP/3 support — a real protocol test, not just a header guess. Free.
HTTPS/SSLIP & ASN Lookup
Resolve a domain's IP address and look up its ASN, hosting provider, and network registry. Free, instant, no signup.
DomainOpen Redirect Checker
Test a domain's common redirect parameters for unvalidated open redirects — a favorite vector for phishing links. Free, instant.
HeadersSubdomain Finder
Discover subdomains that have had a public SSL certificate issued, using Certificate Transparency logs. Free, instant.
DNSTLS Cipher & Protocol Scanner
See exactly which TLS protocol versions a server accepts — including outdated ones that create a downgrade attack surface. Free, instant.
HTTPS/SSLCookie Scanner
Scan the cookies a site sends: check for the Secure, HttpOnly, and SameSite attributes, with a plain-English explanation of what each risk means.
CookiesDNS Lookup
Instant DNS lookup: A, AAAA, MX, TXT, and NS records for any domain, with a plain-English explanation of each record type.
DNSDNSSEC Checker
Check whether DNSSEC is enabled and correctly configured for a domain: DS and DNSKEY records, and full signature validation.
DNSSPF/DKIM/DMARC Checker
Check whether your domain's email is protected: SPF record, DKIM (common selectors), and DMARC policy, with plain-English explanations.
EmailHash Generator & Identifier
Generate and identify MD5, SHA-1, SHA-256, SHA-384, and SHA-512 hashes right in your browser. Nothing is sent to a server, results are instant.
EncodingJWT Decoder
Decode a JSON Web Token (header, payload, expiration) and verify its HS256 or RS256 signature right in your browser. Nothing is sent to a server.
Encoding