Security headers checker
🔒 Runs locally in your browser. Nothing you enter is uploaded.
How to use it
- Run curl -sI https://yoursite.com and copy the output.
- Paste it into the box.
- Fix the missing headers to raise your grade.
Frequently asked questions
Which header matters most?
Content-Security-Policy is the main defence against XSS; HSTS enforces HTTPS.
Do I need X-Frame-Options?
Use CSP frame-ancestors, or X-Frame-Options for older browsers, to stop clickjacking.
More free security tools
🔑🎲#️⃣🔁🎫📊
Password strength checker
See how long a password would survive offline cracking, and why.
Password generator
Cryptographically random passwords and memorable passphrases.
SHA-256 hash generator
SHA-1/256/384/512 of text or a file, and compare against a known hash.
Base64 encoder/decoder
Base64, Base64URL, URL, Hex, HTML entities and ROT13, both ways.
JWT decoder
Decode a JSON Web Token and flag risky settings. Decoding is not verifying.
CVSS calculator
Score a vulnerability and get its vector string.