Free Security Tools
The same checks I run at the start of engagements, free and instant. Everything here tests only systems you own or are authorized to test - attackers already have better tools than these.
Port Scanner
See your network the way an attacker does: which ports answer from the internet.
Open tool →PasswordsPassword Breach Checker
Check any password against billions of leaked ones - it never leaves your browser.
Open tool →OSINTEmail Breach Checker
Find out which data breaches contain your email address.
Open tool →PasswordsHash Identifier
Paste a hash, learn the likely algorithm - MD5, SHA, bcrypt, NTLM and 90+ more.
Open tool →WebSecurity Headers Checker
Does your site send HSTS, CSP and the headers that stop real attacks?
Open tool →ScanningFull Perimeter Scan
A broader external look at your exposed services - the free first step of every engagement.
Open tool →Why free?
Two reasons, and neither is a trick. First, these checks are the top of the funnel, not the product. A port scan tells you which doors are visible from the street; it says nothing about what is behind them. A real engagement goes much further - authenticated testing, manual exploitation, attack-path chaining - and that depth is what I charge for. The free tools exist to show you a slice of your exposure, accurately, so you can decide whether the rest is worth paying to see.
Second, once these tools are built, the cost of running one more check for one more visitor is close to zero. Metering that behind a signup form would harvest email addresses and burn trust in equal measure. I would rather you test your own infrastructure at 2am, find something that bothers you, and come back when you want the full picture.
One rule covers everything on this page: authorized use only. Point these tools at systems you own or have written permission to test. That is not a disclaimer I paste on to cover myself - it is the entire line between security testing and attacking someone. If you want to know how I work and what a real engagement looks like, read about how I work.
What these tools can't see
Everything here is external and unauthenticated - the same view any anonymous visitor on the internet gets. That view matters, but it is one slice. These tools cannot log in, so they cannot test what a normal user can do once inside: read another tenant's data, approve their own refund, or pivot from the web server to the backup network.
They also cannot chain findings. Real breaches rarely come from one critical bug. They come from three medium ones that only matter together: an outdated service, a file share readable by Everyone with a script containing a database password inside, a service account that happens to be a local admin on the domain controller. Each item on its own looks boring. Chained together, they are the breach. That gap is the core difference between a scan and a test - I wrote a full breakdown in penetration test vs. vulnerability scan.
And they cannot see inside your network at all. No external tool will tell you that a domain user still has Summer2026 as a password, that a payroll spreadsheet sits on a share readable by Authenticated Users, or that AD CS is misconfigured in a way that quietly hands domain admin to any authenticated user. Finding that requires an internal, authenticated engagement - see network penetration testing for the network and Active Directory side, or the full list of services if you are not sure where to start.
If a tool here just showed you something worse than you expected - ports you never opened answering from your IP, your email sitting in a breach you never heard of - do not ignore it, and do not start deleting things to feel safe. Work through what to do when you have been hacked first, then decide whether you want help.
Tool questions
Yes - as long as you point them only at systems you own or have explicit written authorization to test. Scanning your own servers and domains is legal in virtually every jurisdiction, and scanning a client's infrastructure with their written permission is too. Scanning strangers is not, and it is traceable. That is the whole line between a security test and an attack, and every tool here asks you to confirm the target is yours before it runs.
The password breach checker never sends your password anywhere - the comparison happens entirely in your browser. Server-side checks like the port scanner keep a temporary log so your results can be generated and returned, and it is deleted automatically afterwards. Nothing you enter here is sold, shared, or added to a marketing list.
Anything you own or administer: your public IP addresses, domains, and websites. If the target belongs to a client, get written authorization first - one email is the difference between a legitimate security test and a crime. If you cannot prove the target is yours or that you are allowed to test it, do not scan it.
Accurate about what they show, honest about what they do not. An open port is an open port, and a missing header is missing. But these are external, unauthenticated checks - one slice of your exposure. They cannot see authenticated weaknesses, internal misconfigurations, or the chained attack paths that manual testing is built to find, so a clean result here is reassurance, not proof.
No. No signup, no email address, no trial that expires. Every tool runs the moment you open it. If you want to go deeper after that, the next steps are the free perimeter scan and a scoping call - but nothing on this page gates your results behind a form.
Found something you don't like?
That's the point. Book a free scoping call and we'll scope a proper test.