Security & Privacy Tools

The 9 tools in this category cover two distinct testing domains. Client-side tools execute in the browser using JavaScript APIs and reveal what any website can passively detect about a visitor. Server-side tools send outbound requests from the tool server to the domain entered and reveal how that server is configured from an external perspective — the same view an attacker or an auditor would have.

Client-side tools use browser JavaScript APIs directly — no request leaves your machine. The Browser Fingerprint Test reads screen.width, screen.colorDepth, navigator.userAgent, and Intl.DateTimeFormat().resolvedOptions().timeZone to generate a hash identical to what tracking scripts collect. The WebRTC Leak Test uses the WebRTC API to communicate with a STUN server (RFC 5389), causing the browser to reveal local and public IP addresses — including the real IP even when a VPN routes all other traffic. Network researcher Paolo Stagno found that 23% of tested VPN providers leaked real IPs through WebRTC. The Global Privacy Control Test reads the Sec-GPC HTTP request header sent by the browser, detecting whether the Do Not Sell/Share opt-out signal is active per the W3C Global Privacy Control specification — required for compliance under CCPA and similar US state privacy laws.

Server-side tools make outbound connections from the tool server to the domain entered. The SSL Certificate Checker performs a live TLS handshake (RFC 8446) on port 443 to retrieve the certificate issuer, expiry date, trust chain depth, and whether the HSTS header (RFC 6797) is present. The HTTP Header Checker issues an HTTP GET request and returns all response headers — security-relevant headers include Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, and Permissions-Policy. The HTTP/2 Support Test negotiates an ALPN extension (RFC 7301) during the TLS handshake to detect whether the server advertises h2 protocol support (RFC 7540). The Brotli Compression Test sends Accept-Encoding: br and checks for Content-Encoding: br in the response. The Secure Cookie Checker inspects Set-Cookie response headers for the Secure, HttpOnly, and SameSite attributes defined in RFC 6265.

VPN users verifying their privacy configuration. A user connects their VPN and runs the WebRTC Leak Test to confirm the VPN is not exposing their real IP through the browser's WebRTC API. If a real IP appears, they disable WebRTC in browser settings or install the WebRTC Network Limiter extension. They then run the Browser Fingerprint Test to check whether their fingerprint hash changes across sessions — if it is stable, sites can track them even without cookies.

Web developers auditing a new deployment's security headers. A developer launches a new web application and uses the HTTP Header Checker to confirm that the Content-Security-Policy, X-Frame-Options, and HSTS headers are present and correctly configured. They follow up with the SSL Certificate Checker to verify the certificate chain is complete and HSTS is active, then run the Secure Cookie Checker to confirm session cookies have the HttpOnly and Secure flags set before going to production.

System administrators investigating a suspicious email. An administrator receives a phishing report and pastes the raw email headers into the Email Header Analyzer. The tool reconstructs the delivery path from the Received headers, extracts the originating IP of the sender's mail server, and parses the Authentication-Results header to show whether SPF, DKIM, and DMARC checks passed or failed — identifying whether the email was spoofed at the protocol level.