Free Security Tools
for Developers
SSL checking, header analysis, JWT decoding, DNS lookups, password strength, cryptographic hashing — all in one place. No signup, no tracking.
$ all-tools --list
SSL Checker
Verify SSL/TLS certificate details, issuer, expiry date, and certificate chain for any domain.
HTTP Header Analyzer
Analyze HTTP response headers and check security headers like CSP, HSTS, X-Frame-Options.
JWT Decoder
Decode JSON Web Tokens to inspect header, payload, and expiration without a secret key.
Password Strength Checker
Analyze password strength with entropy calculation, crack time estimate, and improvement suggestions.
Base64 Encoder / Decoder
Encode and decode text to and from Base64 format. Fully client-side — your data never leaves the browser.
Hash Generator
Generate MD5, SHA-256, and SHA-512 cryptographic hashes from any text input. 100% client-side.
DNS Lookup
Query DNS records (A, AAAA, MX, TXT, NS, CNAME) for any domain using public DNS API.
SPF Record Checker
Fetch and parse SPF (Sender Policy Framework) records for a domain to validate email security.
WHOIS Lookup
Retrieve domain registration details including registrar, registrant, creation date, and expiry.
robots.txt Analyzer
Fetch, parse, and validate robots.txt. Check which bots are allowed, view sitemaps, test URL paths.
URL Encoder / Decoder
Encode and decode URLs with percent-encoding. Component mode for query params. 100% client-side.
HMAC Generator
Compute HMAC-SHA256, HMAC-SHA384, HMAC-SHA512. Hex or Base64 output. 100% client-side.
HSTS Checker
Check Strict-Transport-Security header. Verify max-age, includeSubDomains, preload.
Password Generator
Generate secure random passwords with crypto.getRandomValues. Length 8–64, customizable chars.
AES Encrypt / Decrypt
AES-256-CBC encryption and decryption. 100% client-side. PBKDF2 key derivation.
CORS Checker
Check Access-Control-* headers. Verify Allow-Origin, credentials, methods.
Clickjacking Checker
Check X-Frame-Options and CSP frame-ancestors. Detect clickjacking vulnerability.
DKIM Record Checker
Verify DKIM DNS records. Domain + selector → TXT lookup and parse.
DMARC Record Checker
Verify DMARC DNS records. Policy, RUA, RUF, alignment.
Hex Encoder / Decoder
Convert text to hex and hex to text. UTF-8. 100% client-side.
JSON Validator
Validate, format, minify JSON. Error location. 100% client-side.
Timestamp Converter
Convert Unix epoch to date and date to timestamp. Seconds or milliseconds.
CSP Checker
Check Content-Security-Policy. Parse directives, detect unsafe-inline, unsafe-eval.
Port Checker
Check if TCP ports are open. Host + ports → connect test.
UUID Generator
Generate UUID v4 (random). RFC 4122. 100% client-side.
Regex Tester
Test regular expressions. Matches, capture groups, replace. JavaScript.
Lorem Ipsum Generator
Generate placeholder text. Paragraphs or words. Plain or HTML.
HTML Entity Encoder / Decoder
Encode &, <, > to HTML entities. Decode back. Prevent XSS.
Cron Validator
Validate cron expressions. Format: min hour day month weekday.
Mixed Content Checker
Find HTTP resources on HTTPS pages. Paste HTML, scan scripts, images, styles.
RSA Key Generator
Generate RSA 1024/2048/4096 bit keys. PEM format. 100% client-side.
Open Redirect Checker
Analyze URL for open redirect risks. Check redirect params.
Cookie Analyzer
Parse Set-Cookie headers. Check HttpOnly, Secure, SameSite.
Directory Listing Checker
Check if URL exposes directory listing. Index of, file list.
URL Parser
Parse URL into protocol, host, path, query params. 100% client-side.
User-Agent Parser
Parse User-Agent string. Browser, OS, device, bot. 100% client-side.
Uptime Checker
Quick one-off URL check. HTTP status + response time.