Free security tools
Quick security checks, no signup
Fast, passive, privacy-respecting checks to find issues in your apps — no signup, no install. Built by the ZeroSight360 security team.
Free security tools
- JWT Decoder & InspectorDecode and security-audit JSON Web TokensDecode a JWT header and payload and flag security issues — alg:none, weak HMAC, missing expiry, sensitive claims. Runs entirely in your browser.Runs in your browser
- Security Headers ScannerGrade your HTTP security headersEnter a URL and get a graded report on CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, and cookie flags.Fetches the public URL you enter
- CSP AnalyzerAudit your Content-Security-PolicyPaste a Content-Security-Policy and get a directive-by-directive grade with fixes for unsafe-inline, unsafe-eval, and missing protections.Runs in your browser
- Email Authentication AnalyzerCheck SPF, DKIM & DMARCFind out whether your domain can be spoofed: SPF, DKIM and DMARC posture with a clear grade and exact fixes. Passive DNS lookups only.Passive DNS lookups
Practical checks for everyday security work
Use these free security tools during development, incident triage, and release review. They focus on common application and infrastructure signals that are easy to miss: token configuration, browser security policy, HTTP response headers, and email authentication.
Privacy-respecting by design
JWT inspection and CSP analysis run in your browser. URL and DNS checks are passive and explain what is requested before you run them. Do not paste production secrets or sensitive configuration into any online tool.
From signal to remediation
Each result is intended to become an engineering task. Review the explanation, reproduce the issue in a safe environment, apply the fix, and retest before release.
Need deeper coverage? Explore ZeroSight360 security testing services