Free security tools
A shelf of quick, no-account checks — run them on anything you own. Want the full picture? The site scanner grades your whole surface.
Security Header Analyzer
Grade HSTS, CSP, cookies & more for any URL.
Security Header Analyzer
Ready
Checks the HTTP security headers that stop XSS, clickjacking and protocol-downgrade attacks before they ever reach your visitors.
What we'll check
Content-Security-Policy HTTPS always (HSTS) Clickjacking protection MIME-sniffing protection Referrer policy Permissions policy No version disclosure
Enter a URL to grade its security headers. Present headers show green; missing ones are listed with how to add them.
7 checks · read-only request · we never store your site's content
DNS & Email Health
SPF, DMARC & DNS posture for any domain.
Check SPF, DMARC & DNS posture for any domain.
Tech Fingerprint
What a site is built with + exposure peek.
Identify the tech stack + peek for exposed files & security.txt.
Typosquat Finder
Lookalike domains attackers may have grabbed.
Find lookalike domains of your brand that attackers may have registered.
Subdomain Finder
Discover a domain's assets from certificate logs.
Enumerate a domain's subdomains from public certificate logs — find forgotten assets.
AI Surface Detector
Detect AI chatbots / LLM features on a site.
Detect AI assistants / chatbots exposed on a site (a new attack surface).
Prompt Injection Auditor
Test your AI system prompt's resilience to injection.
Paste your AI assistant's system prompt. We test only your prompt — nothing external is touched.
Test your AI system prompt's resilience to prompt injection & jailbreaks.
Email Header Analyzer
Paste headers → SPF/DKIM/DMARC + spoof check.
Paste a raw email's headers. Parsed 100% in your browser.
Password Strength
Entropy & crack-time, 100% in your browser.
Runs 100% in your browser — nothing is ever sent anywhere.
—0 bits entropy
Estimated time to crack (offline)
—