All tools
Network
Your public IP with its hostname, ISP, ASN, location, abuse contact, Tor check, a WebRTC leak test and the headers your browser sends.
Calculate network, broadcast, mask and usable host range for any IPv4 address and prefix, or find the smallest subnet containing two addresses.
Every IPv4 prefix from /0 to /32 with its subnet mask and number of usable addresses.
DNS
Look up A, AAAA, CNAME, MX, TXT, NS, CAA, SOA and SRV records using public resolvers, and compare answers across resolvers.
Check which certificate authorities are allowed to issue TLS certificates for a domain.
Show a domain's TXT records, including SPF, site verification and other policy records.
One-page email security check for a domain: MX, SPF, DKIM, DMARC, MTA-STS, TLS-RPT and BIMI, with what to fix.
Find the mail servers for a domain, in preference order, with their IP addresses.
Validate a domain's SPF record: follows every include, counts DNS lookups against the limit of 10 and flags risky settings.
Check a DKIM selector's public key, or find keys by trying common selectors (Microsoft 365, Google Workspace and others).
Check an IP, or a domain's mail servers, against spam blocklists (Spamhaus, SpamCop, Barracuda and more), with what each listing means.
Trace an email's delivery path hop by hop, spot delays and read its SPF, DKIM and DMARC results. Runs in your browser.
Read the DMARC aggregate reports (XML, .gz or .zip) mailbox providers send you: who sends as your domain and what fails. Runs in your browser.
Fetch and explain a domain's DMARC policy record, tag by tag.
Security
Flattening an SPF record to stay under the 10-lookup limit is part of SPF Check.
Check a server's TLS certificate chain, expiry, hostname match and supported TLS versions. Works for HTTPS, mail and LDAPS ports.
Grade a website's HTTP security headers (HSTS, CSP, X-Frame-Options and more), follow its redirects and see how to fix each one.
Decode a certificate, chain, .p7b bundle or CSR: names, expiry, key, extensions, chain order and signatures. Runs in your browser.
Create a private key and certificate signing request (RSA or ECDSA, with SANs) in your browser. The key never leaves your device.
MD5, SHA-1, SHA-256, SHA-384 and SHA-512 for text or files of any size, and a check against an expected checksum. Runs in your browser.
Decode a JSON Web Token's header and claims, see when it expires, and verify its signature (secret or public key). Runs in your browser.
Find out if a password has appeared in a data breach, using Have I Been Pwned. Your password never leaves your browser.
Passwords
Ready-made strong passwords, passphrases, Wi-Fi keys, API keys, UUIDs and encryption keys. Generated locally in your browser.
Make a random password, memorable passphrase or PIN with exact length and character options and a live strength meter. Local only.
Formatting
Validate, pretty-print or minify JSON.