Cyber Security Tools
100 purpose-built security tools, free and without a sign-up. 77 of them run entirely in your browser, so private keys, tokens, logs and software inventories never leave your machine. Every tool says on its own page exactly where its work happens.
Recently used
Kept in this browser only.
Website security
Check and harden a site you run: headers, TLS, cookies, cross-origin policy, third-party scripts and the certificates behind it.
Website Security Audit
Run one passive scan that combines headers, HTTPS and TLS, the certificate chain, CSP, cookies, CORS, DNS security, email authentication, redirects and mixed content into a single scored report with prioritised fixes.
Website Security Regression Checker
Compare two website security audits and see exactly which controls improved, stayed the same or regressed, with the severity change for each one.
Website Security Score Comparator
Compare the security posture of up to five sites you are authorised to test, normalised by category so the differences are meaningful rather than cosmetic.
CSP Generator
Build a Content-Security-Policy directive by directive, with strict and starter presets, nonce and hash support, live syntax validation and ready-to-paste server configuration.
CSP Report Analyzer
Load csp-report or Reporting API violation data and group it by directive and source, separate genuine blocks from extension noise, and see which policy changes the evidence actually supports.
CSP Nonce and Hash Generator
Generate cryptographically secure CSP nonces and SHA-256, SHA-384 or SHA-512 hashes for inline script and style blocks, with the matching policy fragment.
Trusted Types Readiness Checker
Scan HTML and JavaScript for the DOM sinks Trusted Types governs - innerHTML, document.write, eval and the rest - and see how much work enforcement would take.
Trusted Types Policy Builder
Build a Trusted Types policy skeleton and the CSP directives that enforce it, with a report-only rollout plan and framework-specific notes.
Clickjacking Protection Tester
Check whether a page can be framed by another site, by reading CSP frame-ancestors and X-Frame-Options together and reporting which one actually applies.
Iframe Sandbox Policy Builder
Pick the capabilities an embedded frame genuinely needs and get the minimal sandbox attribute, with warnings for the token combinations that quietly undo the sandbox.
Secure Cookie Builder
Compose a Set-Cookie header for a real scenario - first-party login, cross-site embed, shared subdomain - and have Secure, HttpOnly, SameSite, Domain, Path and prefix choices checked against it.
Website Cookie Inventory Scanner
Inventory the cookies a page sets on a plain visit, with every attribute, scope and lifetime laid out, and flags separated clearly into what was observed and what was inferred.
Redirect Chain Security Analyzer
Follow a redirect chain hop by hop and see HTTPS downgrades, cross-domain jumps, credential-carrying URLs, caching problems and excessive hops in one diagram.
HTTP Methods Exposure Checker
Ask a server which HTTP methods it advertises, using only OPTIONS and HEAD, and read what the answer means for risk - no state-changing request is ever sent.
Server Banner Exposure Checker
See exactly which software names and version numbers a site volunteers in its response headers, and get the configuration lines that stop it.
Cross-Origin Opener Policy Checker
Check a page's Cross-Origin-Opener-Policy, what it isolates it from, and what will break if you tighten it.
Cross-Origin Embedder Policy Checker
Check Cross-Origin-Embedder-Policy and understand which embedded resources must carry CORP or CORS headers before it can be enforced.
Cross-Origin Resource Policy Checker
Check the Cross-Origin-Resource-Policy on a resource and see whether it matches the way that resource is actually embedded.
Cross-Origin Policy Bundle Generator
Generate a compatible COOP, COEP, CORP and CORS set for a stated goal - cross-origin isolation, third-party embeds, a public API, a CDN - with conflicts called out before you ship them.
Third-Party Script Risk Analyzer
List every external script a page loads with its origin, loading strategy, SRI status and referrer exposure, so supply-chain risk is visible rather than assumed.
External Resource Inventory
Inventory every script, stylesheet, font, frame, image and connection hint a page pulls in, split by first and third party, and export it as CSV or JSON.
JavaScript Source Map Exposure Checker
Find out whether a site publishes the source maps its bundles reference, which would put original source and comments within reach of anyone.
Client-Side Secret Exposure Checker
Scan JavaScript, config or any pasted text for API keys, tokens and credentials using high-confidence patterns plus entropy, with every match masked and nothing uploaded.
Vulnerable JavaScript Library Checker
Identify the front-end libraries and versions a page or manifest uses and match them against published advisories, with the evidence for each identification shown.
Website Dependency Inventory
Consolidate the client-side dependencies a site actually loads into one inventory with origins, versions where they can be proven, and an honest uncertainty label on the rest.
Certificate Transparency Search
Search public Certificate Transparency logs for every certificate issued for a domain, with issuers, subject alternative names, validity windows and renewal patterns.
OCSP Status Checker
Find the OCSP responder a certificate names, check whether the server staples a response, and see the revocation status when it can be determined.
CRL Distribution Point Checker
Read the CRL distribution points a certificate publishes and check they resolve, with a clear statement of what CRL data can and cannot tell you.
TLS Cipher Suite Analyzer
See the TLS version and cipher suite a server negotiates, graded for forward secrecy, authenticated encryption and deprecated primitives.
TLS Configuration Generator
Generate a modern or intermediate TLS configuration for Nginx, Apache, IIS, ASP.NET Core or Node, with the client compatibility each profile costs you stated up front.
Certificate and Private Key Matcher
Confirm a certificate and a private key belong together before you deploy them. Both stay in your browser - the key is never uploaded.
CSR Decoder and Validator
Decode a certificate signing request locally to check the subject, SANs, key type and strength, and verify its self-signature, before a CA rejects it.
DANE TLSA Generator and Validator
Generate or check a TLSA record for DANE, with usage, selector and matching type explained and the DNSSEC requirement stated plainly.
OpenAPI Security Auditor
Audit an OpenAPI 2, 3 or 3.1 document for unauthenticated operations, sensitive parameters, insecure server URLs and missing limits, and get a per-endpoint risk table.
GraphQL Schema Security Auditor
Review a GraphQL schema or introspection result for exposed mutations, unbounded lists, missing depth limits and sensitive field names - by reading it, never by querying a live endpoint.
CSRF Defense Configuration Checker
Work through how your app actually defends against cross-site request forgery - cookie attributes, tokens, origin checks - and find the gap between what you think is set and what is.
File Upload Security Policy Builder
Turn upload requirements into a concrete policy - allowed types, size caps, storage, renaming, Content-Disposition, authorisation - with framework snippets that verify on the server.
MIME Type and Magic Byte Checker
Compare a file's extension, its declared MIME type and its actual signature bytes to see whether they agree, with a hex preview and a polyglot warning.
Website Security Remediation Plan
Turn audit findings into a plan someone can work: owner, effort, priority, due date, verification step, quick wins first - exported as Markdown or CSV.
Website Security Audit Report Builder
Build a presentable security report from audit data - scope, executive summary, evidence, remediation - as print-ready HTML, Markdown or JSON, with a check for sensitive fields before you share it.
Identity & cryptography
Tokens, keys, federation and hashing - plus the file and privacy tools that keep sensitive material out of what you share.
JWT Security Analyzer
Go past decoding a JWT: check the algorithm, the registered claims, issuer and audience, lifetimes and key references against the mistakes that make tokens forgeable.
JWT Signature Verifier
Actually verify a JWT signature in your browser with a key you supply, and get a plain verified or not-verified answer instead of a decoded payload that proves nothing.
JWK and JWKS Viewer
Read a JWK or JWKS set properly - key type, use, algorithm, key ID, operations - with thumbprints calculated and duplicate or inconsistent keys flagged.
JWK and PEM Converter
Convert public keys between JWK and PEM in your browser, with the conversions that are not possible named rather than silently skipped.
OAuth PKCE Generator
Generate a cryptographically secure PKCE code verifier and S256 challenge, plus state and nonce, with the point of each one explained in the flow.
OIDC Discovery Analyzer
Read an OpenID Connect discovery document and check its endpoints, supported algorithms and capabilities for the weak or contradictory settings that surprise people later.
SAML Response Decoder
Decode a base64 and DEFLATE-encoded SAML response locally and read the assertion - subject, conditions, audience, timestamps - with XML parsing hardened against entity attacks.
SAML Metadata Analyzer
Inspect SAML metadata for entity IDs, endpoints, bindings and signing certificates, and catch expired certificates and binding mismatches before a federation breaks.
Password Entropy Calculator
Measure how much guessing a password actually resists, with the patterns and dictionary words that shortcut it named, and the estimate's assumptions shown.
Secure Passphrase Generator
Generate passphrases from a curated word list using your browser's cryptographic randomness, with the entropy of each choice shown as you change it.
Password Policy Tester
Build a password policy and test real examples against it, so you find the contradictory rules that block good passwords before your users do.
Argon2 Hash Generator and Verifier
Generate and verify Argon2id hashes in your browser, tune memory, time and parallelism against real timings, and read any PHC string back.
bcrypt Hash Generator and Verifier
Generate and verify bcrypt hashes locally, benchmark the cost factor on your own hardware, and see the 72-byte truncation rule that catches people out.
PBKDF2 Hash Generator and Verifier
Derive and verify PBKDF2 hashes with your own salt, iteration count and digest, using Web Crypto - and see why a derived key is not encryption.
File Checksum Verifier
Drop a file in and compare its checksum against the value you were given, in any of the formats publishers use. The file never leaves your browser.
File Integrity Manifest Generator
Build a SHA-256 or SHA-512 manifest for a whole folder of files, then re-verify it later to see exactly what changed, was added or went missing.
File Type and Magic Byte Detector
Identify what a file really is from its signature bytes rather than its name, with container formats recognised and extension mismatches flagged.
File Entropy Analyzer
Chart a file's entropy chunk by chunk to see where it is compressed, encrypted or padded - with a clear warning that high entropy is not evidence of anything malicious.
PII and Secret Redactor
Redact emails, phone numbers, card numbers, IPs, tokens and keys out of logs or documents before you share them, with every detector reviewable and nothing uploaded.
EXIF Privacy Remover
See what a photo reveals - GPS coordinates, device, timestamps - and strip it out in your browser, keeping the image itself untouched.
Threat intelligence & vulnerabilities
Work with indicators, advisories and software inventories: extract, normalise, score, prioritise and validate.
IOC Extractor
Pull domains, IPs, URLs, file hashes, emails and CVE IDs out of any report or email, automatically refanged, deduplicated and ready to export.
IOC Normalizer and Deduplicator
Clean a messy indicator list into one canonical set - type-aware normalisation, defanging undone, duplicates merged and the ambiguous ones set aside for review.
IOC Defang and Refang Tool
Defang indicators so they are safe to paste into a ticket or email, or refang them back for tooling, in bulk and without touching the surrounding text.
STIX 2.1 Validator
Validate a STIX 2.1 bundle locally against the specification's structural rules, with the exact JSON path of every problem and the object graph drawn out.
IOC to STIX Converter
Turn a reviewed indicator list into a valid STIX 2.1 bundle with proper identifiers, timestamps, patterns and labels, ready for a sharing platform.
Threat Intelligence Report Builder
Write a structured threat report - summary, TTPs, indicators, confidence, timeline, ATT&CK mappings, mitigations - and export it as Markdown, HTML or JSON.
CVE Search
Look up any CVE and get the description, CVSS scores for every version published, CWE, affected products, references and dates, attributed to the source they came from.
CVSS 4.0 Calculator
Score a vulnerability with the full CVSS 4.0 metric set - Base, Threat, Environmental and Supplemental - with the vector string and plain-language meaning of every choice.
EPSS Score Lookup
Get the current EPSS probability and percentile for one CVE or a batch of them, so you can tell likely exploitation from merely high severity.
CISA KEV Lookup
Check whether a CVE is in CISA's Known Exploited Vulnerabilities catalogue, with the required action, due date and whether it is known to be used in ransomware.
Vulnerability Prioritization Calculator
Combine CVSS, EPSS, KEV status, exposure and business criticality into one ranked order, with a formula you can see and adjust rather than a black box.
SSVC Decision Calculator
Work through the SSVC decision tree to get a defensible act, track, attend or immediate outcome, with the reasoning recorded for the ticket.
SBOM Viewer
Open a CycloneDX or SPDX SBOM and actually read it - searchable components, versions, licences, identifiers and the dependency graph - without uploading your inventory anywhere.
SBOM Diff Checker
Compare two SBOMs and see exactly what was added, removed, upgraded or relicensed between them, filtered by what matters for risk.
CycloneDX Validator
Validate a CycloneDX SBOM in JSON or XML against the official schema for its version, with the precise path of every error and what to do about it.
SPDX Validator
Validate an SPDX document in JSON or tag-value form, including the relationship and identifier cross-references that trip up generated files.
Package URL (purl) Parser
Parse, build and normalise purl identifiers with the per-ecosystem rules applied, so the identifier you put in an SBOM actually resolves.
Dependency End-of-Life Checker
Check whether the runtimes, frameworks and databases you depend on are still supported, with end-of-life and end-of-support dates and their source.
Package Typosquatting Checker
Check a dependency name against the popular packages it could be a typo of - edit distance, confusable characters, separator swaps - before you install it.
Vulnerability Report Normalizer
Import scanner output as CSV or JSON, map the columns once, normalise the severities and deduplicate, so findings from different tools can finally be counted together.
Detection, logs, cloud & response
Write and check detection rules, read logs from Windows, web servers and the cloud, and run an incident end to end.
Sigma Rule Validator
Validate a Sigma detection rule's structure, log source and detection logic locally, with the errors pointing at the line that caused them.
Sigma Rule Converter
Convert a validated Sigma rule into a query for the backends supported here, with the conditions that cannot be translated exactly called out rather than silently dropped.
YARA Rule Validator
Parse and lint a YARA rule for syntax, structure and the patterns that will make it slow, and test it against inert sample text - no files are ever scanned on our servers.
Suricata Rule Validator
Check a Suricata rule's header, options, ordering and required metadata, with a formatted version back and no traffic generated at any point.
MITRE ATT&CK Mapper
Search ATT&CK tactics, techniques and sub-techniques and map your detections or incident findings to them, with the framework version recorded.
MITRE ATT&CK Coverage Heatmap
Turn your detection mappings into a coverage heatmap across the ATT&CK matrix, so the gaps are a picture rather than a spreadsheet.
Multi-Format Log Parser
Paste or drop logs in JSON, JSONL, CSV, key-value, CEF, LEEF or syslog and get parsed, filterable, countable fields - detected automatically, processed in your browser.
Windows Event Log Analyzer
Load exported Windows security events as XML, CSV or JSON and get the logon, account and privilege events summarised, filtered and placed on a timeline.
Sysmon Event Analyzer
Read Sysmon events with the event IDs explained, processes linked to their parents, and network, file and registry activity laid out as a timeline.
Web Server Log Analyzer
Parse IIS W3C, Apache or Nginx access logs and get status, latency, path, client and user-agent summaries, with unusual patterns surfaced for triage rather than declared an attack.
AWS CloudTrail Log Analyzer
Load CloudTrail JSON and see who did what, from where and when, with high-risk API calls filtered out - entirely in your browser, and never asking for cloud credentials.
Entra Sign-In Log Analyzer
Analyse Microsoft Entra sign-in exports for failure patterns, applications, locations, devices and conditional-access outcomes, with personal fields redactable before you share.
Authentication Anomaly Analyzer
Look for password spraying, unusual failure bursts, first-seen countries and impossible travel in sign-in logs, with every threshold visible and adjustable.
Log Timestamp Normalizer
Convert a column of mixed timestamp formats into one consistent timezone, with the assumed zone stated, DST ambiguity flagged and the original value kept.
IP and CIDR Subnet Calculator
Work out network, broadcast, ranges, masks and host counts for IPv4 and IPv6, split a block into subnets, or summarise a list of addresses into the fewest CIDRs.
Firewall Rule Analyzer
Import a rule table and find the shadowed, duplicated, overly broad and contradictory rules, with least-privilege suggestions - read-only, nothing is ever pushed to a device.
Cloud IAM Policy Analyzer
Review AWS IAM, Azure role or GCP IAM policy documents for wildcards, excessive permissions, privilege-escalation combinations and missing conditions.
Kubernetes Security Checker
Check Kubernetes manifests for privileged containers, host access, dangerous capabilities, mounted secrets, mutable tags and missing limits or probes.
IaC Security Checker
Review Terraform, CloudFormation or Bicep for public exposure, disabled encryption, missing logging, hard-coded secrets and over-broad identity, with the source line for each finding.
Incident Response Workspace
Run an incident from first alert to lessons learned in one place - severity, timeline, evidence hashes, indicators, actions, communications and chain of custody - kept only in your browser tab unless you choose otherwise, and exported when you are ready.
Security tools already on A2Z.Tools
The checkers this section was built around. They are listed here because a visitor looking for a security tool does not care which release it shipped in.
Headers and browser policy
Certificates and TLS
DNS and domain intelligence
Email authentication
Cryptography and identity basics
Site hygiene and disclosure
What these tools are for
This section covers the work of defending something you are responsible for: a website, an identity system, a software supply chain, a detection pipeline, or an incident in progress. The tools are deliberately narrow and deterministic. Each one does a job you can check, shows the evidence behind its answer, and tells you what it could not determine.
Where your data goes
Most of these tools never send your input anywhere. Anything that parses a file, decodes a token, hashes a password, reads a log or validates a schema runs in your browser using the Web Crypto API and standard browser parsers, and the page says Runs locally. That matters because the inputs here are exactly the things you cannot afford to upload: private keys, signed tokens, software inventories, sign-in exports and incident notes.
Tools that look at a live website say Passive public check. They read what any visitor's browser would receive - response headers, certificates, DNS records - using safe, read-only requests. They do not log in, submit forms, guess paths or test for vulnerabilities. Tools that consult an outside authority such as the National Vulnerability Database say Uses an external data source and name the source on the page.
What a passing result means
It means the specific things a tool could observe looked correct at the moment it looked. It does not mean a system is secure. Passive configuration checks cannot see application logic, access control, business logic flaws or anything behind authentication, and no tool here performs active testing. Where a check cannot be completed, these tools report unknown rather than quietly counting it as a pass - treating an unanswerable question as good news is how scanners end up flattering the systems they measure.
Standards and sources
Guidance follows current published sources rather than opinion: the OWASP project, MDN for web platform behaviour, the relevant IETF RFCs, NIST and CISA for practice and catalogues, FIRST for CVSS and EPSS, and MITRE ATT&CK for adversary behaviour. Individual tools link the specific source behind a specific claim.
What these tools deliberately do not do
There is no exploitation here, and there will not be. No payload generation, no brute forcing or credential testing, no port scanning, no directory or subdomain enumeration, no stress testing and nothing designed to evade detection. These are tools for defending systems you are responsible for, and the passive checks are limited to what any ordinary visitor already receives.
Related Tools
More tools in the same category
Other Tools
Popular tools from across A2Z
Rate this tool
Was this tool useful? Your feedback helps us improve it.