Free · No signup

Free security tools

Fast, free tools for security engineers, developers, and bug hunters. Client-side tools never send your data to a server. Scanners run one passive request against the URL you enter.

Check your security headers Open the CVSS calculator

Scanners

Passive checks against a public URL or domain, with a grade and fixes.

Security Headers Checker
Grade a site's HTTP security headers and get the fixes
Open tool
SSL/TLS Checker
Check a certificate, its expiry, chain, and TLS protocol support
Open tool
Email Security Checker
Check SPF, DMARC, DKIM, MTA-STS, and BIMI records for a domain
Open tool
Subdomain Finder
Discover the subdomains of any domain from passive sources
Open tool
CORS Checker
Test a URL for CORS misconfigurations that expose data to any origin
Open tool

Calculators

Score and budget tools for triage, reporting, and program planning.

Analyzers

Decode and inspect tokens, headers, and payloads in your browser.

In-browser
JWT Decoder & Analyzer
Decode JWTs and spot weak algorithms, expiry, and secrets
Open tool

Vulnerability data

Reference pages that the tools link into.

CVE Database
Every CVE with CVSS, EPSS, CISA KEV status, affected software, and fix guidance.
Open tool

Need more than a spot check?

Strix runs an autonomous penetration test against your application, validates every finding with a working exploit, and opens fix PRs.

Start for free All free tools →

Free security tools

Scanners

Security Headers Checker

SSL/TLS Checker

Email Security Checker

Subdomain Finder

CORS Checker

Calculators

CVSS Calculator

Bug Bounty Calculator

Analyzers

JWT Decoder & Analyzer

Vulnerability data

CVE Database

Need more than a spot check?