Free security tools.
DNS lookup
Every common record type for a domain, as 1.1.1.1 resolves it.
Email security check
SPF, DMARC, DKIM, MTA-STS and BIMI, with records to fix what is missing.
Security headers check
CSP, HSTS, framing and five more, graded, with fixes for Next.js, Vercel and Cloudflare.
SSL certificate check
Issuer, names and expiry from Certificate Transparency, and HSTS preload status.
security.txt checker
Validate a site's security.txt against RFC 9116, or generate one.
Package vulnerability lookup
Known advisories for an npm or PyPI version, with severity and fixed versions.
JWT decoder
Header, claims and expiry, with alg none and weak claims flagged. In your browser.
Secret checker
Finds strings that look like Stripe, AWS, OpenAI, GitHub and Supabase keys. In your browser.