Useful tools, behind no email wall
Every tool here runs entirely in your browser. Nothing you type is transmitted to us, logged, or stored — there is no server to send it to. No signup, no email capture, no drip sequence afterwards.
Why these are ungated
Gating a CVSS calculator behind a form is a poor trade: it captures a handful of addresses and costs the goodwill of everyone else. We would rather the tools be genuinely useful and let the work argue for itself. If you find them valuable, the free finding is the natural next step.
Interactive tools
Client-side only. Safe to use with real values — though as a general habit, avoid pasting production secrets into any web page, including ours.
CVSS v3.1 calculator
Build a vector from the base metrics and get the score, severity band and shareable string as you go.
Open the calculatorJWT decoder
Decode header, payload and signature, then see the weaknesses we would flag on an engagement: alg: none, symmetric signing where asymmetric was intended, missing expiry, overlong lifetimes and sensitive claims sitting in a payload that is merely encoded rather than encrypted.
Open the decoderPassword entropy checker
True entropy rather than the theatre of a strength meter, with crack time estimated against realistic offline attack rates. Demonstrates why P@ssw0rd! scores well on most meters and falls in under a second.
Open the checkerPentest readiness assessment
Ten questions on scope, environment, credentials, authorisation and remediation capacity. Produces a readiness score and the specific gaps to close first. Organisations that score badly here tend to waste a meaningful share of their testing budget.
Start the assessmentReference material
Written from findings that recur across engagements, rather than rewritten from vendor documentation.
Security headers guide
Paste your response headers for a graded review, then read what each header does, how to roll out a Content-Security-Policy without breaking your application, and which widely recommended headers no longer do anything useful.
Read and checkEmail spoofing prevention guide
Check your SPF record against the ten-lookup limit, review your DMARC policy and build one to publish. Covers the failure modes we see most: DMARC parked on p=none indefinitely, and subdomains left open while the primary domain is locked down.
Read and checkWhat these tools will not tell you
A header grade, an entropy figure and a clean SPF record are all worth having, and none of them answers the question that matters: can someone reach your data. Automated checks find symptoms. Every finding we report is verified by hand, because a scanner cannot tell you whether four low-severity issues chain into one that takes your database.
What happens to what you type
- Nothing leaves your browser. Every tool is client-side JavaScript. There is no API call, no form submission and no backend to receive input.
- Nothing is stored. No cookies are set by the tools and no values persist. Reload the page and it is gone.
- No analytics on input. We do not instrument what you enter, and we could not read it if we wanted to.
- Verify it yourself. Open developer tools and watch the network tab while you use them. That is a reasonable habit with any security tool, including ours.
Full detail in the privacy notice.
Tools find symptoms. Testers find paths.
A header checker cannot tell you whether someone can reach your customer data. We will test one scoped target and show you a verified finding, free.