Security Toolkit

Free Security Tools

Fast, passive, privacy-respecting checks to find issues in your apps — no signup, no install. Built by the ZeroSight360 security team.

JWT Decoder & Inspector

Decode and security-audit JSON Web Tokens

terminal

$ zerosight jwt --decode eyJhbGci...

Decode a JWT header and payload and flag security issues — alg:none, weak HMAC, missing expiry, sensitive claims. Runs entirely in your browser.

Open tool →

Security Headers Scanner

Grade your HTTP security headers

terminal

$ zerosight headers --scan target.com

Enter a URL and get a graded report on CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, and cookie flags.

Open tool →

CSP Analyzer

Audit your Content-Security-Policy

terminal

$ zerosight csp --audit "default-src 'self'"

Paste a Content-Security-Policy and get a directive-by-directive grade with fixes for unsafe-inline, unsafe-eval, and missing protections.

Open tool →

Email Authentication Analyzer

Check SPF, DKIM & DMARC

terminal

$ zerosight email --check domain.com

Find out whether your domain can be spoofed: SPF, DKIM and DMARC posture with a clear grade and exact fixes. Passive DNS lookups only.

Open tool →

Developer security toolkit

Practical checks for everyday security work

Use these free security tools during development, incident triage, and release review. They focus on common application and infrastructure signals that are easy to miss: token configuration, browser security policy, HTTP response headers, and email authentication.

Privacy-respecting by design

JWT inspection and CSP analysis run in your browser. URL and DNS checks are passive and explain what is requested before you run them. Do not paste production secrets or sensitive configuration into any online tool.

From signal to remediation

Each result is intended to become an engineering task. Review the explanation, reproduce the issue in a safe environment, apply the fix, and retest before release.

Need deeper coverage? Explore ZeroSight360 security testing services →