HTTP Security Header Checker
Audit pasted response headers locally for common browser security protections
Related guides
Security Headers Checker — Grade and Fix HTTP Response Headers
Fetch live headers, get an A–F grade, and read MDN-linked fixes for HSTS, CSP, clickjacking, and more.
Content-Security-Policy: Build It Right, Then Audit It
A practical guide to authoring a strong Content-Security-Policy and auditing one you already ship. How default-src, unsafe-inline, wildcards and frame-ancestors affect your real XSS protection.
HTTP Security Headers Explained: HSTS, CSP, and the Rest
A practical guide to response security headers. What HSTS, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy actually do, and the weak values to avoid.
Related tools
AES Encryption
Encrypt and decrypt text with AES-GCM and a passphrase, fully in your browser. Uses PBKDF2 key derivation and the Web Crypto API — your data and keys never leave your device.
Basic Auth Generator
Generate an HTTP Basic Authentication header from a username and password. Produces the Authorization header and ready-to-use curl and fetch snippets. Runs fully client-side.
Bcrypt Generator & Verifier
Hash passwords with bcrypt and verify hashes — choose your cost factor (rounds 4–15), get a secure hash instantly, and check whether a password matches a hash. Runs entirely in your browser.
BIP39 Mnemonic Generator
Generate and validate BIP39 seed phrases locally for testing
Checksum Calculator
Compute file checksums (SHA-1, SHA-256, SHA-384, SHA-512) in your browser with the Web Crypto API
Client-Side File Encryptor
Encrypt any file with AES-256-GCM and PBKDF2 directly in your browser — no uploads, no accounts, wrong passwords fail loudly.