Free Security & SSL tools

Checker

SSL Certificate Checker

Check a website's SSL/TLS certificate: whether it is valid, who issued it, and exactly how many days are left before it expires.

Open New Tool

SSL Certificate & CSR Decoder

Decode an SSL certificate, chain or CSR: SANs, issuer, expiry, key size, fingerprints and chain order, with warnings for SHA-1, weak keys and long lifetimes.

Open Checker

TLS Version Checker

Check which TLS versions a website supports. Make sure TLS 1.2 and 1.3 are on and the deprecated TLS 1.0 and 1.1 are switched off.

Open Checker

Security Headers Checker

Scan a website's HTTP security headers — HSTS, Content-Security-Policy, X-Frame-Options, Referrer-Policy and more — with Nginx and Apache fixes.

Open Tool

Security Headers Generator

Generate HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy headers as ready-to-paste Nginx, Apache, Netlify or PHP config.

Open Tool

Content Security Policy Generator

Build a Content-Security-Policy header with presets for Google Analytics, Google Fonts, YouTube and Stripe. Report-only mode and Nginx, Apache and meta tag output.

Open New Checker

Website Safety Checker (Is This Site Legit?)

Check if a website is safe or a scam: domain age, SSL certificate, HTTPS, spam blocklists, contact details, policies and lookalike addresses in one report.

Open Tool

Password Generator

Generate a strong password from a word you choose, a random-word passphrase or a random password. Shows entropy in bits. Runs in your browser; nothing is sent.

Open New Checker

Mixed Content Checker

Find insecure http:// scripts, stylesheets, images, iframes and forms on an HTTPS page, see which browsers block, and check if each file works over https.

Open Tool

Hash Generator (MD5, SHA-256…)

Generate MD5, SHA-1, SHA-256, SHA-384 and SHA-512 hashes of text or files, in hex or Base64, with HMAC and checksum matching. Nothing is uploaded.

Also in Developer Open Tool

JWT Decoder

Decode a JSON Web Token to read its header and payload, see exp, iat and nbf as real dates with expiry status, and verify HS256, HS384 or HS512 signatures.

Also in Developer Open Checker

Email Blacklist Checker

Check if your mail server IPs are on email blacklists (DNSBLs) like SpamCop, PSBL and UCEPROTECT, and find out how to get delisted.

Also in Email & deliverability Open