Resources · Tools
Six quick checks you can run right away: email domain, website headers, password and address in breach lists, password generator and file hash. No account needed.
What is available
Each tool looks at one specific place and answers one question. The result appears straight on the page, including an explanation of what the individual findings mean and why they matter. There is no account to create and nothing is unlocked in exchange for your contact details. The one exception is the breach check for an address — there we do need the address, because that is where the verification link goes. Querying a breach database about someone else's mailbox without the owner confirming it would not be right.
Reads the SPF and DMARC records and the DKIM selector you choose from public DNS. Shows how strictly the rules are written and whether SPF stays within the limit of ten DNS lookups. Useful when you are dealing with fraudulent messages sent in your name, or with the deliverability of your own mail.
Open the check → HTTP · response headersFetches the response headers the way an ordinary browser does and goes through HSTS, the content policy, Referrer-Policy, Permissions-Policy and protection against framing the page. Useful before a site goes live, or when you need to know what the site has configured and what it does not.
Open the check → Breaches · check in the browserCompares the password against a list of passwords from publicly known breaches. The hash is computed in the browser and only its first five characters are sent out; the password itself never leaves the browser. Useful when you are picking a new password, or checking one you have been using somewhere for years.
Open the check → Passwords · generated in the browserGenerates a random password of the length you choose, or a passphrase from English words, and shows the entropy of each in bits. The randomness comes from the operating system generator and the whole computation runs in the browser — the generated password is never sent anywhere and never stored.
Open the generator → Breaches · mailbox verificationCompares the email address against lists from publicly known breaches. The result is shown only after you confirm the link sent to that mailbox — so nobody can look up someone else's address without the owner knowing.
Open the check → Files · hash in the browserComputes the hash of the file directly in your browser and compares it against a database of confirmed malware. The file never leaves your device — only the 64 characters of the hash are sent. Useful for a suspicious attachment you would rather not open.
Open the check →Need to go through more than one place?
A quick check is a good start. When you need to know how the environment stands as a whole, the website and the infrastructure behind it can be gone through as part of a security assessment.