Real security tools, free to use.

What it is

A domain footprint analyzer gives you a single, plain-English snapshot of what the outside world can see about a domain, who it's registered to, where its DNS points, which security protections are in place, and what technology it's likely running. It's the same starting picture a real attacker would build during reconnaissance, condensed into one report.

When to use it

Run it before you launch a new site, after a domain changes hands, or any time you want a second opinion on whether your public-facing setup actually matches what you think it does. It's also a fast way to sanity-check a vendor or partner's domain before you trust it.

Why it matters

Most breaches start with information an attacker gathered for free, in public, before ever touching your systems. Knowing what that reconnaissance actually turns up is the first step in closing the gap.

What it is

An email breach checker tells you whether an email address has turned up in a known, publicly disclosed data breach, and if so, which one, and roughly when. It draws on one of the most widely used breach-verification databases available.

When to use it

Check any email you use for something sensitive, banking, work accounts, admin logins, periodically, and especially right after you hear about a breach at a service you use. It's also a quick way to explain to a colleague why password reuse is a real, specific risk rather than an abstract warning.

Why it matters

A breached password doesn't stay contained to the site it was stolen from, attackers reuse leaked credentials against other accounts by default, a technique called credential stuffing. Knowing you're exposed is what lets you actually act on it.

What it is

A CVE lookup tool pulls the real, current record for a specific vulnerability, its severity score, affected products, and description, straight from the official national vulnerability database. Type in a CVE ID and get the actual official data, not a summary.

When to use it

Use it whenever you see a CVE ID mentioned, in a vendor security advisory, a news article, a patch changelog, and want to know how serious it actually is before deciding how urgently to act. It's also useful for double-checking a vulnerability a scanner flagged.

Why it matters

Not every CVE deserves the same urgency, and severity scores directly change how a vulnerability should be prioritized against everything else on your plate.

What it is

An IP info lookup tells you what's publicly known about a given IP address, its rough geographic location, which internet provider or hosting company owns it, and its timezone. Leave it blank and it shows you your own.

When to use it

Use it to sanity-check where a login, connection, or suspicious request actually originated, or to confirm your own public IP before configuring a firewall rule or allowlist that depends on it.

Why it matters

An unfamiliar login location is often the first visible sign of a compromised account, but only if you actually check where a connection came from instead of assuming.

What it is

A JWT decoder/encoder reads a JSON Web Token, the kind of credential most modern apps and APIs use to keep you logged in, and shows you exactly what's inside it: who it was issued to, what permissions it claims, and when it expires. It can also verify a signature or build a new token from scratch, entirely in your browser.

When to use it

Use it while debugging an authentication flow, checking whether a token actually expires when it should, or reviewing what claims an API is really sending, without needing to trust a random online decoder with a live credential.

Why it matters

A token that never expires, trusts the wrong signing algorithm, or leaks more than it should in its payload is a genuinely common, genuinely exploitable mistake. Understanding what's actually in your tokens is the first step to catching it.

What it is

A blacklist (RBL) checker looks up a domain's mail server or an IP address against the DNS-based blacklists that mail providers actually consult before deciding whether to deliver, or silently drop, an email. Being listed on even one of these is often invisible until your mail stops arriving.

When to use it

Check it whenever legitimate email from your domain starts landing in spam, bounces unexpectedly, or before you switch mail providers or IP ranges and want to confirm you're starting clean.

Why it matters

A blacklisting can happen for reasons entirely outside your control, a shared IP range, a misconfigured neighbor, and it can quietly cost you real business communication for weeks before anyone notices.

What it is

A security headers scanner checks any website's actual response for the handful of headers that tell a browser how to defend that site, protections against clickjacking, content sniffing, and cross-site scripting among them, and grades what it finds from A+ down to F.

When to use it

Run it on your own site after a deploy or a platform migration, or on a vendor's site before you decide how much to trust them with sensitive data. It takes seconds and needs nothing but a URL.

Why it matters

These headers are free, one-time configuration, not a purchased feature, and their absence is one of the most common, most overlooked gaps we find in real assessments.

What it is

A subdomain finder surfaces the subdomains publicly associated with a domain, the staging or old-app subdomain you may have forgotten existed, by searching the public certificate log record every HTTPS certificate ever issued gets added to.

When to use it

Run it periodically against your own domain to catch forgotten or abandoned subdomains before someone else finds them first, especially after a platform migration or a project that got quietly decommissioned.

Why it matters

An old, unmaintained subdomain is one of the most common ways an organization gets compromised without realizing it still had exposure, often pointing at software nobody's patched in years.

What it is

A domain reputation checker scores how trustworthy a domain looks to the outside world, mail providers, browsers, and automated trust systems, across several real factors, and separately audits whether its email authentication (the records that stop attackers from spoofing your domain) is actually configured correctly.

When to use it

Check it before you launch a new domain for marketing email, after setting up email authentication for the first time, or whenever you want to confirm a domain hasn't quietly picked up a bad reputation.

Why it matters

A missing or misconfigured DMARC record is one of the single most common reasons a domain gets impersonated in phishing attacks aimed at your own customers or employees, and it's entirely fixable once you know it's wrong.

What it is

This tool measures how long a password would realistically take to crack, based on real entropy math, not an arbitrary length rule, and, in reverse, generates a genuinely strong random password or a memorable passphrase on demand.

When to use it

Use it to test a password you're about to reuse across accounts (a habit worth breaking), or to generate a new one for an account that actually matters, without relying on a service that stores what you typed.

Why it matters

Weak, reused, or predictable passwords remain one of the most common ways attackers get in, not through a sophisticated exploit, just a guess that worked.

What it is

This tool encodes or decodes Base64 text, and generates MD5, SHA-1, SHA-256, SHA-384, or SHA-512 hashes from any input, the kind of everyday encoding and fingerprinting operations developers and security reviewers run constantly, without needing a script for a one-off check.

When to use it

Use it to quickly verify a file's checksum, decode a Base64-encoded token or config value while debugging, or generate a hash for a piece of data without pasting it into an unknown third-party site.

Why it matters

A surprising number of real security issues come down to sensitive data sitting in plain sight because someone assumed Base64 encoding meant it was protected. It isn't, it's encoding, not encryption, and getting that distinction right matters.

What it is

A domain doppelganger (typosquat) finder generates the realistic lookalike domains someone could register to impersonate your brand, common misspellings, swapped characters, different endings, and checks real DNS records to see which of them are already registered.

When to use it

Run it against your own brand periodically, and especially before a major campaign or product launch, when attackers are most likely to register a convincing lookalike to intercept your traffic or your customers' trust.

Why it matters

A registered lookalike domain is a ready-made tool for phishing your own customers or employees, often invisible until someone reports a suspicious email that looks exactly like yours.

What it is

A JavaScript beautifier takes minified, compressed, or just badly formatted JavaScript, the kind shipped to production or pasted from a random source, and reformats it into clean, properly indented, readable code, without changing what it actually does.

When to use it

Use it whenever you're staring at a wall of unreadable JavaScript and need to actually understand it, debugging a third-party script, reviewing code from an unfamiliar source, or just making your own minified build readable again for a moment.

Why it matters

You can't evaluate what you can't read. A surprising number of real findings during a code review start with simply making the code legible enough to look at properly.

What it is

A JavaScript deobfuscator goes a step further than formatting, it decodes the specific tricks used to deliberately hide what code does: string characters encoded as escape sequences or character-code arrays, base64-wrapped text, and the classic "eval-packer" format still used constantly in the wild today.

When to use it

Use it on a suspicious script you've encountered, an unexpected browser extension, a snippet found on a compromised page, something flagged during a review, to get a readable sense of what it actually does before deciding how concerned to be.

Why it matters

Obfuscation exists specifically to make code hard to review, which is itself a signal worth paying attention to. This tool never executes what you paste, even the packed payload itself, so it's safe to point at something you don't yet trust.

What it is

A scam checker examines a link's actual structure, not its content, for the patterns that show up constantly in real phishing campaigns: a well-known brand name paired with a domain that isn't actually theirs, IP addresses standing in for domain names, punycode characters designed to visually mimic real letters, and a handful of other well-documented tricks.

When to use it

Paste a link before you click it, from an unexpected email, a text message, a social media DM, or anywhere else a suspicious link shows up, especially anything asking you to log in, verify an account, or enter payment details urgently.

Why it matters

Phishing links are engineered to look legitimate at a glance; the tells are almost always in the URL's actual structure, not something visible in a quick read. This checks the structure only, it never visits the link itself.

What it is

An email header analyzer reads the technical metadata behind an email, invisible in your inbox, but included in every message, showing you the real sending server, whether the message passed SPF/DKIM/DMARC authentication, and whether the From, Reply-To, and Return-Path addresses actually agree with each other.

When to use it

Use it on any email that feels slightly off before you act on it, an unexpected invoice, an urgent password-reset request, anything asking you to click through and log in, by pasting the full raw headers your mail client can show you ("Show original" in Gmail, "View source" in Outlook).

Why it matters

A well-crafted phishing email can look identical to a real one in the inbox view, the headers are where the inconsistencies that give it away actually live, like a Reply-To address that quietly goes somewhere the From address never mentioned.

What it is

This tool checks whether a specific password has already appeared in the breach datasets Have I Been Pwned has indexed, using k-anonymity, a technique where only a small fragment of the password's hash is ever sent anywhere, so the real password never leaves your browser and can't be reconstructed by anyone, including us.

When to use it

Check any password you're about to start using, especially one you've used before, a password that's already in a breach dataset is effectively public, regardless of how complex it looks.

Why it matters

A strong-looking password and a safe password are different things, if it's already leaked, its complexity doesn't matter, attackers already have it. Pair this with our Password Strength Checker for the full picture.