Free
No signup
Fast

Security Toolkit

HTTP security headers, TLS, cookies, CORS, redirects, DNS, secrets, JWT, passwords, hashes, HMAC, bcrypt, security.txt, SRI, and email auth — plus agent playbooks for full audits and ship gates.

security tools
CORS Policy Checker
Fetch a URL with a probe Origin and report Access-Control-Allow-* gaps, wildcards, and Origin reflection.
Free
security tools
CSP Policy Evaluator
Paste a Content-Security-Policy string to flag unsafe-inline/eval, missing default-src, and reporting gaps.
Free
security tools
Cookie Security Analyzer
Parse Set-Cookie flags for Secure, HttpOnly, and SameSite on a live URL response.
Free
security tools
DNS Lookup
Resolve A/AAAA/MX/TXT/NS/CNAME and report DNSSEC-related DS/DNSKEY/RRSIG presence (not full chain validation).
Free
security tools
HMAC Generator
Compute HMAC digests and optionally compare an expected signature (timing-safe when lengths match).
Free
security tools
HTTP Security Redirect Checker
HTTP→HTTPS upgrades, loops, long chains, and open-redirect-looking query params.
Free
security tools
Hash Generator
Compute MD5, SHA-1, SHA-256/384/512, or SHA-3 digests of text in one place — with legacy warnings for MD5/SHA-1.
Free
security tools
JWT Decoder
Decode JWT header and payload with weak-alg warnings — signature is not verified here.
Free
security tools
JWT Signature Verifier
Verify HS*/RS*/ES* JWT signatures with a pasted secret, PEM public key, or JWK — complements decode-only JWT Decoder.
Free
security tools
Password Hash Generator (bcrypt / Argon2)
Generate bcrypt or Argon2id password hashes for local auth testing — same URL, dual algorithms.
Free
security tools
Password Strength Checker
Estimate password strength from length, charset mix, entropy heuristics, and a short common-password list.
Free
security tools
SPF / DKIM / DMARC Checker
Look up SPF, common DKIM selectors, and DMARC TXT records for a domain or URL hostname.
Free
security tools
SSL/TLS Certificate Checker
Inspect a live HTTPS certificate or paste PEM/CSR offline for subject, expiry, and fingerprint.
Free
security tools
Secret Leak Scanner
Heuristic scan of pasted env/config/log text for API keys, tokens, PEM keys, and JWTs.
Free
security tools
Secure Password Generator
Generate a cryptographically random password with configurable length and character sets.
Free
security tools
Security Headers Analyzer
Score CSP, HSTS, XFO, and related HTTP security headers on a live URL.
Free

About the Security Toolkit toolkit

Use the Security Toolkit when you need to harden a site or debug auth — security headers, TLS, cookies, CORS, redirects, DNS, secret leak scans, JWT decode, password tools, hashes, HMAC, bcrypt, security.txt, subresource integrity, and SPF/DKIM/DMARC. Open any tool in the browser with no signup. API-backed via REST and MCP on one API key. Agents can run web-security-audit, ship-gate, and related playbooks, then verify until gates pass (or stop). Not a penetration test, malware scanner, or breach monitor.

Frequently asked questions

What jobs does the Security Toolkit cover?

Web response hardening, developer crypto helpers, DNS lookup, and email authentication DNS. It is not antivirus, port scanning, a penetration test, or a breach database.

Do I need an account?

No for browser use. Create a developer account only for REST or MCP access (500 free credits/month shared).

Can agents run a full security audit?

Yes — use MCP playbooks such as web-security-audit and ship-gate, then verify until pass or stop. See security audit.