Free Tools
A free toolset to check dependencies (OSV), CVEs, security headers, CSP, JWT, and SPF/DKIM/DMARC. Diagnostic tools also generate an AI fix prompt. Client-side tools never send your input.
π Client-side tools never send your input. Server-side diagnostic tools state exactly how they handle data on each tool's page.
Site Security Audit
A full audit of your own (ownership-verified) site: secret exposure (.env/.git/DB dumps), TLS cert, headers, CSP weaknesses, CORS misconfig, cookie flags and email auth β plus correlation of exposed products against our CISA KEV (actively-exploited) catalog. Graded report, fixes, AI prompt, and free continuous monitoring.
- .env/.git exposure
- TLS cert
- CSP & CORS
- Cookie flags
- Email auth
- KEV correlation
- Overall grade
- Monitoring
Server-side diagnostics
Check your own site/domain (some require ownership verification)
Site Transparency Checker
Enter a URL to surface a page's external destinations, trackers and forms β signals for whether it's really client-side.
CVE / KEV Lookup
Enter a CVE id to see CVSS, EPSS (exploit probability), KEV (actively exploited?) and fixes in one place β ITD's own feed DB + NVD.
Security Headers Check
Enter your site's URL to grade its HTTP security headers (CSP, HSTS, X-Frame-Options, β¦) with fixes, a copy-paste hardened set, and an AI fix prompt.
SPF / DKIM / DMARC Checker
Enter a domain to check its SPF / DKIM / DMARC DNS records β the anti-spoofing email auth β with the gaps, fixes, and an AI fix prompt.
Browser-only tools
Your input never leaves your browser (nothing sent)
CSP Builder / Checker
Paste a Content-Security-Policy to flag risky directives (unsafe-inline, etc.) and build a stricter policy.
JWT Decoder / Inspector
Decode a JWT's header and payload and check for risks like alg:none or expiry.
Secret Leak Scanner
Paste code or config to find hardcoded API keys, tokens and private keys.
Password Strength / Generator
Measure password strength (entropy, crack-time estimate) and generate strong passwords.
Dependency Vulnerability Scanner
Paste package.json or a lockfile to check its libraries for known vulnerabilities (CVEs) via OSV.dev β with fixed versions and an AI fix prompt. Runs in your browser.