Security Tools
Draft CSP and CORS headers, test password strength locally, and read HTTP security references. This is not a pentest of your site.
11 tools · 100% browser-based · No uploads · No signup
About these Security tools
Security tools help you draft CSP and CORS headers, test password strength locally, look up HTTP status codes, and walk through headers, OWASP Top 10, misconfig patterns, and password storage recommendations. They are references and builders, not a pentest of your site.
CSP and CORS mistakes cause either XSS holes or broken production. Password tester uses entropy and dictionary heuristics in the browser; it does not submit the password. Header snippets are starting points for NGINX, Apache, and Node. Threat model is a STRIDE worksheet, not an automated scanner of your repo.
Tools in this category
CSP Generator
Build a Content Security Policy visually and get warnings about unsafe directives.
CORS Generator
Assemble Access-Control headers by choosing origins, methods, and options.
Password Tester
Check password strength with entropy, estimated crack time, and dictionary checks — entirely in your browser.
HTTP Status Codes
A quick reference to every HTTP status code, explained with examples.
X-Frame-Options
Understand X-Frame-Options and how DENY and SAMEORIGIN help prevent clickjacking.
Security Headers
A cheat sheet of HTTP security headers, each explained with examples.
OWASP Top 10
An interactive checklist for tracking OWASP Top 10 (2021) coverage, with examples.
Misconfig Detector
Scan headers and config files for common security misconfigurations.
Headers Checklist
Secure headers implementation checklist. Framework-specific snippets for NGINX, Apache, Node. Security headers setup guide.
Password Storage
Password storage best practices generator. Algorithm recommendations, salt, pepper, cost factors. Secure password hashing guide.
Threat Model
Run a quick STRIDE-style threat model with risk levels for your web app.
How these tools run in your browser
Header generators concatenate directives from checkboxes. Password scoring is local zxcvbn-style analysis. Misconfig detector matches patterns in headers or config text you paste. OWASP and header checklists are editorial content with copy-paste snippets.
Common Use Cases
- Draft a Content-Security-Policy and see which directives are unsafe
- Build Access-Control-Allow-* headers for a specific origin
- Check a password you are about to use on a throwaway account (still never reuse production passwords in a webpage if you can avoid it)
- Look up what 425 or 451 means
- Walk an OWASP checklist before a release
Common Mistakes
Frequently Asked Questions
No. Strength analysis runs in the tab. Use a password manager for real secrets.
It is a draft. You still need to add your real script hashes or nonces and test in report-only mode.
No. Use it as a checklist and a header builder. Hire review for anything that handles money, health, or large PII.