01Local browser tool
Security Header Analyzer
Review pasted HTTP response headers against current browser-security controls without sending data anywhere.
MDN HTTP Observatory methodologyOpen tool
30 transparent security utilities
Security checks that show their work.
Every tool on this page runs locally in your browser. Results explain what was checked, what could not be proven and which published standard informed the guidance.
Designed for useful triage
30working tools
- No account or forced email gate
- No pasted secret or file upload
- No fake “site is secure” verdict
- Official source linked per tool
Live URL, DNS and TLS scans require a server-side verifier and are intentionally not simulated here.
30 tools
No matching tool found. Try a broader term.
Website defence
7 practical tools
Headers and browser policies that reduce common web attack paths.
02Local browser tool
Content Security Policy Analyzer
Parse a Content-Security-Policy value, identify risky source expressions and explain missing defence-in-depth directives.
OWASP Content Security Policy Cheat SheetOpen tool
03Local browser tool
Content Security Policy Generator
Build a conservative CSP starting point for a static site, web application or API endpoint.
OWASP Content Security Policy Cheat SheetOpen tool
04Local browser tool
Cookie Security Analyzer
Review one or more Set-Cookie lines for Secure, HttpOnly, SameSite and prefix requirements.
MDN Set-Cookie referenceOpen tool
05Local browser tool
CORS Policy Analyzer
Inspect pasted CORS response headers and flag combinations that are invalid or unnecessarily broad.
MDN CORS guideOpen tool
06Local browser tool
Permissions Policy Builder
Create a browser Permissions-Policy header that disables or limits sensitive device capabilities.
MDN Permissions-Policy referenceOpen tool
07Local browser tool
Referrer Policy Advisor
Choose a privacy-appropriate Referrer-Policy and preview what information it shares across origins.
MDN Referrer Policy guidanceOpen tool
Source review
5 practical tools
Static checks for HTML, forms, resources and supply-chain controls.
08Local browser tool
HTML Security Auditor
Statically inspect pasted HTML for common browser-side security hazards without executing it.
OWASP HTML5 Security Cheat SheetOpen tool
09Local browser tool
Mixed Content Scanner
Find HTTP resources, form actions, media and CSS URLs that can undermine an HTTPS page.
MDN Mixed Content guidanceOpen tool
10Local browser tool
Third-Party Script Inspector
Inventory external and inline scripts in pasted HTML and highlight integrity and loading controls.
MDN Subresource Integrity guidanceOpen tool
11Local browser tool
Secure Form Reviewer
Review HTML forms for insecure transport, sensitive GET submissions and credential-handling signals.
OWASP CSRF Prevention Cheat SheetOpen tool
12Local browser tool
Subresource Integrity Hash Generator
Create SHA-384 or SHA-512 integrity metadata for a local script, stylesheet or pasted resource body.
MDN Subresource Integrity guidanceOpen tool
Cryptography
3 practical tools
Deterministic hashing and message-authentication utilities using Web Crypto.
13Local browser tool
File Checksum Calculator
Calculate and optionally verify SHA-256, SHA-384 or SHA-512 for a local file.
MDN Web Crypto digest referenceOpen tool
14Local browser tool
Text Hash Generator
Generate SHA-256, SHA-384 or SHA-512 for UTF-8 text entirely in the browser.
MDN Web Crypto digest referenceOpen tool
15Local browser tool
HMAC Generator and Verifier
Generate or compare an HMAC using a local secret and the Web Crypto API.
MDN Web Crypto sign referenceOpen tool
Identity
7 practical tools
Local password, token and authentication-format utilities.
16Local browser tool
Password Strength Checker
Use a transparent, length-first heuristic aligned with current NIST guidance rather than invented crack-time claims.
NIST SP 800-63B-4Open tool
17Local browser tool
Secure Password Generator
Create an unbiased password with cryptographically strong browser randomness and selected character sets.
MDN cryptographic randomness referenceOpen tool
18Local browser tool
Local Passphrase Generator
Generate a multi-word passphrase from a bundled word list using cryptographic browser randomness.
NIST SP 800-63B-4Open tool
19Local browser tool
Secure Random Token Generator
Generate random hex or base64url tokens for development and security workflows.
MDN cryptographic randomness referenceOpen tool
20Local browser tool
UUID v4 Generator
Generate one or more standards-shaped UUID version 4 identifiers using browser cryptography.
MDN randomUUID referenceOpen tool
21Local browser tool
JWT Decoder and Time Claim Checker
Decode JWT header and payload locally and interpret exp, nbf and iat time claims without pretending to verify the signature.
RFC 7519: JSON Web TokenOpen tool
22Local browser tool
TOTP Code Generator
Calculate a standards-based time one-time password locally from a Base32 secret.
RFC 6238: TOTPOpen tool
Privacy and data
5 practical tools
Inspect and transform data without sending it to a remote service.
23Local browser tool
URL Privacy and Safety Analyzer
Parse a URL and highlight credentials, sensitive query names, insecure schemes and redirect parameters.
WHATWG URL StandardOpen tool
24Local browser tool
Base64 and Base64url Tool
Encode or decode UTF-8 text using standard Base64 or URL-safe Base64 without uploading it.
MDN Base64 referenceOpen tool
25Local browser tool
HTML Entity Encoder and Decoder
Encode text for HTML text context or decode character references without executing the result.
OWASP XSS Prevention Cheat SheetOpen tool
26Local browser tool
Email Header Analyzer
Review pasted message headers for authentication-result signals, routing hops and sender-domain mismatches.
RFC 8601: Authentication-ResultsOpen tool
27Local browser tool
File Signature Checker
Compare a local file extension and reported MIME type with common leading-byte signatures.
MDN MIME type guidanceOpen tool
Discovery
3 practical tools
Technical discovery files for search engines, AI crawlers and security contacts.
28Local browser tool
Robots.txt and AI Crawler Analyzer
Inspect pasted robots.txt rules for search and AI crawler access, keeping search and training controls distinct.
OpenAI publisher crawler guidanceOpen tool
29Local browser tool
XML Sitemap Validator
Validate a pasted or local XML sitemap for structure, URL quality, duplicates and date formatting.
Google sitemap guidanceOpen tool
30Local browser tool
Security.txt Generator and Validator
Create or review an RFC 9116 security contact file for the well-known security.txt location.
RFC 9116: security.txtOpen tool
Responsible scope
A browser utility is evidence, not a penetration test.
These tools inspect only the content you provide. They cannot prove that a production system is secure or replace an authorised assessment.