Free Tools
A free toolset to check dependencies (OSV), CVEs, security headers, CSP, JWT, and SPF/DKIM/DMARC. Diagnostic tools also generate an AI fix prompt. Browser-based tools never send your input to this site's server (the ones that query a public database such as OSV.dev state exactly what they send).
Initial response to data leaks and fake warnings
Choose what happened and organize immediate steps and official resources. No personal details or automatic diagnosis.
See what to do first →Software support deadlines
Find your product and version, check official support dates and plan the next update or migration.
Find a support deadline →PHP fixed-version comparison
Choose a catalogued CVE and compare your provider and full version with published fixes. No scan or safety guarantee.
Compare a PHP version →Learn by trying
AI agent permissions and approval
Try four fictional scenarios: instructions in documents, file access, allowed destinations and approval for deletion. All decisions run in your browser, with no real actions or AI API calls.
Try the four exercises →Site Security Audit
Place the dedicated code and use the same browser used for setup to check fixed items on the site you manage: accidental exposure of .env/.git and similar files, TLS, headers, and email authentication. The reference assessment is not a complete audit. The verification method for continuous monitoring is being prepared for migration.
- .env/.git exposure
- TLS cert
- CSP & CORS
- Cookie flags
- Email auth
- KEV correlation
- Overall grade
- Monitoring paused
Server-side diagnostics
Check your own site/domain (some require ownership verification)
Site Transparency Checker
Without registration, check external scripts and form destinations in the HTML of the homepage and similar pages. Individual paths are not fetched. This does not verify actual network activity or guarantee that no data is sent.
CVE / KEV Lookup
Enter a CVE id to see CVSS, EPSS (exploit probability), KEV (actively exploited?) and fixes in one place — ITD's own feed DB + NVD.
Security Headers Check
Without registration, the server fetches public headers from the homepage and similar pages and provides a reference assessment of CSP, HSTS, and related settings. Individual paths and URLs with queries are excluded, and unchecked items are identified separately.
SPF / DKIM / DMARC Checker
Without registration, check SPF, DKIM, and DMARC settings in public DNS. No HTTP requests are made to the web server, and signatures or sender alignment in actual emails are not verified.
API
Password Strength, Leak Check & Generator
The reference strength assessment and password generation run in your browser. The optional leak check sends the first five characters of the hash to an external API. No match does not guarantee safety.
Dependency Vulnerability Scanner
Paste package.json or a lockfile to check its libraries for known vulnerabilities (CVEs) via OSV.dev — with fixed versions and an AI fix prompt. Nothing goes through this site's server.
Browser-only tools
Your input never leaves your browser (nothing sent)
CSP Builder / Checker
Paste a Content-Security-Policy to flag risky directives (unsafe-inline, etc.) and build a stricter policy.
JWT Decoder / Inspector
Decode a JWT's header and payload and check for risks like alg:none or expiry.
Secret Leak Scanner
Paste code or config to find hardcoded API keys, tokens and private keys.
CVSS Calculator & Vector Reader
Paste a CVSS vector to compute the v3.x base score exactly per the spec and read what each metric means (v4.0: metric explanations).