Security & Privacy Tools

Find sensitive paths exposed in robots.txt like admin panels, backups, and databases.

Analyze cookies for Secure, HttpOnly, and SameSite flags. GDPR compliance checker.

Check if WordPress XML-RPC is exposed and assess attack surface risks.

Detect common admin URLs that may expose login panels or sensitive areas.

Detect if directories expose file listings revealing sensitive documents and structure.

Check if website is protected against clickjacking with X-Frame-Options and CSP.

Analyze robots.txt to detect exposed admin, login, and sensitive paths.

Detect insecure HTTP resources loaded on HTTPS pages that break browser security.

Detect open directories and exposed file listings on websites.

Test which HTTP methods are allowed - find PUT, DELETE, TRACE vulnerabilities.

Test password strength with real-time feedback. 100% private - runs in your browser.

Detect exposed email addresses on web pages and reduce spam risks.

Scan common ports to find security risks like exposed databases, SSH, and RDP.

Check if website implements essential security headers like CSP, HSTS, X-Frame-Options.

Check if domain is blacklisted.

Detect weak HTTPS enforcement and improper HTTP to HTTPS redirects.

Check if domain is suspicious.

Check Secure and HttpOnly flags on cookies to identify session security risks.

Find exposed email addresses in HTML.

Analyze HTML forms for CSRF-related security attributes and risks.

Generate strong random passwords. Custom length, bulk generation, strength indicator. 100% secure and private.

Grade security headers with detailed scoring, letter grades (A+ to F), and actionable recommendations.

Check if site has malware.

Build a Content-Security-Policy header visually. Pick directives and sources, then copy the header or meta tag. Reduce XSS risk.

Generate Subresource Integrity (SRI) hashes (SHA-256/384/512) for scripts and stylesheets. Paste content or upload a file.

Scan a site for exposed sensitive files — .env, .git, backups, .htpasswd, phpinfo and more — graded exposed / protected / not found, with soft-404 detection. Free.

Check how a URL handles CORS — see its Access-Control-Allow-* headers from a real cross-origin request and preflight, and get flagged on wildcard, origin-reflection, and credential risks. Free.

Paste a Content-Security-Policy and get a graded report — flags unsafe-inline, unsafe-eval, wildcards, and missing object-src, base-uri, and frame-ancestors. Runs in your browser. Free.

Create a valid RFC 9116 security.txt file — set your security contact, expiry, encryption key, and policy, then copy or download it for /.well-known/security.txt. Free.

Encrypt and decrypt text with a password using AES-256-GCM via your browser's Web Crypto. Nothing is uploaded. Free.

Generate a hardened .htaccess — force HTTPS, block sensitive files, disable directory listing, stop hotlinking and bad bots, and add security headers. Copy or download. Free.

Create a free, self-contained cookie consent banner — customise text, buttons, position and colours, preview live, and copy a snippet that remembers each visitor's choice. No plugins.

Create a valid DMARC TXT record — set policy, reporting addresses, alignment and percentage — to stop email spoofing of your domain. Copy the record for _dmarc.yourdomain. Free.

Compute SHA-256, SHA-1, SHA-384 or SHA-512 checksums for any file and compare against an expected value to verify integrity. Files never leave your device. Free.

Build a correct SPF TXT record by ticking the services that send your email, with a live DNS-lookup counter so you stay under the 10-lookup limit. Runs in your browser. Free.

Generate cryptographically secure random tokens — API keys, secrets, session IDs, UUIDs and salts — in your browser. Choose format and length, generate in bulk. Nothing is stored. Free.

Build hardened HTTP security headers (HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, CSP starter) and copy them as Apache or Nginx config. Runs in your browser. Free.

Check if a password has appeared in a known data breach — without sending it anywhere. Uses k-anonymity: only a 5-character hash prefix leaves your browser. Free and private.