🛠️ Free Security Tools
Fifty-eight tools, no signup required. Checklists, calculators, generators, live feeds, simulations, and 30+ network/security utilities — built by practitioners across SOC, GRC, pen testing, and DFIR. Everything runs in your browser.
Ransomware Readiness Checklist
10 questions on backups, segmentation and response — score plus a downloadable gap list.
Cyber Insurance Readiness Checker
The controls insurers actually look for — MFA, backups, EDR — scored against typical underwriting questions.
DPDP Act Quick-Check
A fast gut-check on how your personal-data handling stacks up against India's DPDP Act, 2023.
MFA & Access Control Self-Assessment
Eight questions on MFA coverage, privileged access and access reviews — identity-focused.
SOC-CMM Maturity Assessment
15-question, 5-domain assessment with instant gauge scoring across people, process, technology, detection, and response.
Industry Maturity Benchmark
Already have a SOC-CMM score? See how it compares to illustrative ranges for your industry.
CERT-In Reporting Deadline Calculator
Enter your detection time, get the exact six-hour cutoff and a who-to-call checklist.
Data Breach Cost Estimator
Industry and record count in, a rough breach-cost range out — useful for budget conversations.
SOC Staffing Calculator
Alert volume and coverage hours in, an estimated analyst headcount for 24×7 coverage out.
Vendor Risk Questionnaire Generator
Pick your industry, get a tailored third-party security questionnaire to send to vendors.
IR Contact Tree Builder
Fill in your roles and names, get a printable escalation tree for the wall.
Security Policy Pack Generator
Pick which policies you need, get downloadable starter outlines for each.
Tabletop Exercise Scenario Picker
Choose your top concern, get a free scenario script to run with your IR team.
Phishing Email Simulator
A realistic inbox view — click the parts of the email that gave the scam away.
Spot the Fake Login Page
Find the tells on a spoofed login page before you'd ever type a password.
Vishing Call Simulator
A simulated "IT support" call — pick your responses and see what gave the scam away.
Email Spoofing Risk Checker
SPF, DKIM and DMARC analyzed instantly — see how easy it'd be to spoof email from your domain.
Typosquat & Lookalike Domain Detector
Generates likely typosquat variants of your domain and checks which are actually registered.
Domain Age Checker
See exactly when any domain was registered — a brand-new domain is a classic scam signal.
CISA Known Exploited Vulnerabilities
Vulnerabilities actively being exploited right now — refreshed from CISA's public catalog.
Live Phishing Domain Watcher
Watches Certificate Transparency logs in real time for newly-issued lookalike-brand certs.
Global Threat Activity Map
Real, recently-reported malicious IPs, geolocated and visualised — refreshed hourly.
Email Header Analyzer
Paste raw headers, get SPF/DKIM/DMARC results and the server hop path — parsed in your browser.
Dependency Vulnerability Checker
Paste your package.json or requirements.txt, checked against Google's free OSV.dev database.
Port & Protocol Reference
Searchable reference of common ports, what runs on them, and why each one matters.
Bulk IP / Domain Lookup
Lookup up to 100 IPs or domains at once — Country, Region, City, ISP, ASN, Lat/Long. Export CSV, JSON, XML or YAML.
DNS Lookup
Query DNS records (A, AAAA, MX, NS, TXT, CNAME, SOA) for any domain.
Reverse DNS
Convert IP address to hostname via PTR record lookup.
IP Lookup
Get ISP, ASN, and geolocation for any IP address.
Subnet Calculator
Calculate network, broadcast, hosts from CIDR notation.
TCP Port Info
Common port reference - find what service runs on any port.
JWT Decoder
Decode and inspect JWT tokens - header and payload.
Hash Calculator
Generate SHA-256, SHA-1, and MD5 hashes from text.
Password Generator
Generate secure random passwords with custom options.
UUID Generator
Generate random UUIDs (v4) instantly.
IOC Defanger/Refanger
Defang or refang IPs and URLs for safe sharing.
Base64 Encode/Decode
Convert text to/from Base64 encoding.
URL Encode/Decode
Encode or decode URL-encoded strings.
Hex Converter
Convert text to/from hexadecimal.
Binary Converter
Convert text to/from binary.
Epoch Converter
Convert Unix timestamps to dates and vice versa.
JSON Formatter
Format and validate JSON data.
IP to Binary
Convert IP address to binary format.
IP to Hex
Convert IP address to hexadecimal.
IP to Decimal
Convert IP address to decimal number.
IP Class Checker
Determine the class (A, B, C, D, E) of an IP address.
Private IP Check
Check if an IP address is private or public.
Screen Resolution
Detect your screen size, viewport, and pixel ratio.
User Agent Parser
Parse and analyze user agent strings.
Browser Info
Detailed browser capabilities and settings.
World Clock
Current time in major cities around the world.
Date Calculator
Add or subtract days from a date.
Age Calculator
Calculate age from date of birth.
QR Code Generator
Generate QR codes from text or URLs.
Regex Tester
Test regular expressions against sample text.
Color Picker
Pick colors and convert between HEX, RGB, HSL.
What This Website Already Knows About You
Live browser exposure demo — see your own fingerprint surface the instant you load the page.
Build the Kill Chain
Drag the stages of a cyber attack into the correct order — a quick game, not just a quiz.
Operation Foothold — Mini CTF
A real three-clue capture-the-flag challenge hidden in page source, HTTP headers, and cookies.
// RANSOMWARE READINESS CHECKLIST
// CYBER INSURANCE READINESS CHECKER
// DPDP ACT 2023 QUICK-CHECK
// MFA & ACCESS CONTROL SELF-ASSESSMENT
// SOC-CMM MATURITY ASSESSMENT — 5 DOMAINS
Rate each statement 1 (not in place) to 3 (fully implemented)
// INDUSTRY MATURITY BENCHMARK
// CERT-IN 6-HOUR REPORTING DEADLINE CALCULATOR
// DATA BREACH COST ESTIMATOR
// SOC STAFFING CALCULATOR
// VENDOR RISK QUESTIONNAIRE GENERATOR
// IR CONTACT TREE BUILDER
// SECURITY POLICY PACK GENERATOR
Select policies to include:
// TABLETOP EXERCISE SCENARIO PICKER
// PHISHING EMAIL SIMULATOR
Click every red-flag tell you can spot in this email. Find all 5.
Dear Valued Customer,
We have detected suspicious activity on your account. To avoid suspension, you must verify your details immediately.
Click here to verify: www.paypal-secure-verify.net/login
If you do not verify within 24 hours, your account will be permanently closed.
Regards,
The PayPal Security Team
// SPOT THE FAKE LOGIN PAGE
This is a spoofed Google login. Click every tell you can find. Find all 4.
Sign in to continue
// VISHING CALL SIMULATOR
// EMAIL SPOOFING RISK CHECKER
// TYPOSQUAT & LOOKALIKE DOMAIN DETECTOR
// DOMAIN AGE CHECKER
// CISA KNOWN EXPLOITED VULNERABILITIES
Loading CISA KEV catalog...
// LIVE PHISHING DOMAIN WATCHER
// GLOBAL THREAT ACTIVITY MAP
Live threat map from Radware — real-time attack traffic visualised globally.
Data sourced from Radware's global sensor network. Refreshed in real time.
// EMAIL HEADER ANALYZER
// DEPENDENCY VULNERABILITY CHECKER
// PORT & PROTOCOL REFERENCE
// WHAT THIS WEBSITE ALREADY KNOWS ABOUT YOU
This data was collected the moment you opened this panel — no button click needed.
// BUILD THE KILL CHAIN — DRAG TO REORDER
Drag the stages into the correct Cyber Kill Chain order, then check your answer.
// OPERATION FOOTHOLD — MINI CTF
Three clues hidden in this page. Find all three flags to complete the challenge.
CLUE 1 — Page Source
The first flag is hidden in the HTML source of this page. Open DevTools → Elements or view-source and search for FLAG{
CLUE 2 — Browser Cookie
The second flag is stored in a cookie named ctf_flag_2. Open DevTools → Application → Cookies to find it.
CLUE 3 — localStorage
The third flag is in localStorage under key ctf_flag_3. Open DevTools → Application → Local Storage to find it.