Security tools for recon, encoding and network planning

Resolve A, AAAA, MX, NS, TXT, CNAME, SOA and CAA records for a domain, with TTLs and the DNSSEC flag.

Find the PTR hostname behind a public IPv4 or IPv6 address: the name its owner set up for reverse DNS.

Registrar, creation and expiry dates, status and name servers for a domain or IP, from RDAP with a WHOIS fallback.

Country, city, ASN and organisation for a public IP address, from a local database.

Enumerate subdomains from certificate transparency logs and a top-500 DNS wordlist. Only for domains you may test.

Grade a site's security headers A to F: HSTS, CSP, framing, sniffing, referrer, permissions, COOP and cookies.

Inspect the certificate chain, expiry, hostname match, supported TLS versions and weak ciphers of a server.

Detect the web server, frameworks, CMS and libraries a site runs, with the evidence for each match.

TCP connect scan of the top 20 or top 100 ports of a host you own or are authorised to test.

Parse raw email headers: the Received hops, SPF, DKIM and DMARC results and the sending path.

Score a CVSS 4.0 or 3.1 vector string, see every metric explained, and draft a 4.0 vector from a 3.1 one.

Paste a Content-Security-Policy and get it graded A to F: unsafe-inline, wildcards, object-src, base-uri, nonces and bypassable hosts.

Extract IPs, domains, URLs, emails, hashes, CVE and ATT&CK ids from text, and defang or refang them for sharing.

Rate a finding with the OWASP Risk Rating Methodology: 16 likelihood and impact factors to an overall severity.

Encode text to Base64 or decode it back, UTF-8 safe, with the URL-safe alphabet as an option.

Percent-encode text for URLs and query strings, or decode an encoded string.

Escape text into HTML entities (named or numeric) or turn entities back into characters.

Convert text to hexadecimal bytes and back, UTF-8 aware, in your browser. Spaces in hex input are ignored.

Decode a JSON Web Token's header and payload and explain its claims. The signature is not verified.

Convert text to 8-bit binary or decimal byte codes and back, UTF-8 aware, in your browser.

Decode a SAMLRequest or SAMLResponse (Redirect or POST binding), pretty-print the XML and review issuer, audience, conditions and signatures.

Score a password 0 to 4 with zxcvbn and estimate how long it resists offline and online guessing. Never logged.

Compute the MD5 digest of text. Legacy only: MD5 is broken for security use.

SHA-1, SHA-256, SHA-384 and SHA-512 digests of text, computed with the browser's Web Crypto.

Guess the algorithm behind a hash from its length, alphabet and format (MD5, SHA, bcrypt, NTLM and more).

Generate strong random passwords in the browser with crypto.getRandomValues. Nothing leaves the page.

Generate up to 100 random version 4 UUIDs at once with crypto.randomUUID, in your browser.

Decode a PEM certificate, chain or CSR: subject, issuer, validity, key, SANs, extensions and SHA-256 fingerprint.

Verify a JWT's signature with a secret, PEM or JWK key, or sign a payload (HS, RS, PS, ES), in your browser.

Network, broadcast, mask, wildcard, host range and host count for an IPv4 or IPv6 address and prefix.

Convert between CIDR prefixes, dotted subnet masks and wildcard masks, for IPv4 or IPv6.

Identify the manufacturer of a network card from the OUI of its MAC address, offline.

Test a JavaScript regular expression against text and see every match and capture group highlighted.

Explain a five-field cron expression in plain words and list its next five run times.

Convert Unix timestamps (seconds or milliseconds) to dates and dates back to timestamps, in UTC and local time.

Pretty-print, minify and validate JSON, with the line and column of the first error.

Break a User-Agent string into browser, engine, operating system and device type.

Generate HSTS, CSP, framing, referrer and permissions headers as nginx, Apache, IIS web.config, Caddy or _headers config.

Create an RFC 9116 security.txt with Contact, Expires, Policy and Encryption fields, validated as you go.

Build a Cisco IOS extended access-list entry from action, protocol, source, destination and port.

Generate consistent Cisco interface description lines from the interface, location, device and VLAN, one at a time or as a range.

Check a whole VLAN plan: every subnet and gateway, duplicate IDs and overlapping subnets, then print the IOS configuration for all of the VLANs.