Free tools for security analysts
Small, fast tools for the jobs that come up in every investigation. No sign-up, no limits.
Every tool runs in your browser. Nothing you paste is uploaded, stored or logged.
- Safe Links & URL Defense decoderUnwrap Microsoft Safe Links, Proofpoint URL Defense (v1, v2, v3), Barracuda and Google redirect links to the real address, without clicking them.
- IOC extractorPaste an email, alert, log or threat report and get every IP, domain, URL, email address, file hash and CVE, de-duplicated, defanged and ready to copy or export.
- Defang / refang URLs and IPsMake URLs, IPs, domains and email addresses unclickable (hxxps[://]evil[.]example) before sharing them, or turn defanged indicators back into real values.
- Email header analyzerPaste raw email headers to see the delivery route hop by hop, SPF, DKIM and DMARC results, the sender’s real IP and the warning signs of phishing, without uploading anything.
- PowerShell decoderDecode PowerShell -EncodedCommand, Base64, Deflate and GZip loaders and common obfuscation into readable script, with suspicious commands and indicators picked out. Nothing is executed.
- Timestamp converterConvert Unix (s, ms, µs, ns), Windows FILETIME and LDAP/AD, Chrome/WebKit, macOS/Cocoa, HFS+ and Excel timestamps to UTC and local time, or turn a date into every format.
- File hash calculatorGet the MD5, SHA-1, SHA-256 and SHA-512 hash of any file or text, and check it against a known hash. Files are hashed on your device and never uploaded.
- Port reference for securityWhat runs on common ports, whether each should face the internet, the attacks it is known for and what it means when it shows up in your logs: RDP, SMB, SSH, Redis, Docker and more.
- Lookalike domain & punycode checkerConvert
xn--punycode to readable text and back, and spot homograph and typosquatting tricks: mixed alphabets, Cyrillic lookalikes, brand names in subdomains and one-letter swaps. - Subnet calculatorWork out the network, broadcast, usable range, mask, wildcard and host count for any IPv4 or IPv6 CIDR, and check which IPs fall inside it.
- JWT decoderDecode a JSON Web Token's header and payload, see when it expires, and get warned about alg none, missing expiry, jku/kid tricks and sensitive data. The token never leaves your browser.
- Hash identifierPaste a hash to see what it probably is: MD5, NTLM, SHA-1, SHA-256, bcrypt, sha512crypt, Kerberos, NetNTLMv2 and more, with hashcat modes and where each type usually comes from.
- Windows Event ID referenceWhat each Windows security event means, why it matters, what to check and how to turn it on: logons, Kerberos, account changes, services, scheduled tasks, PowerShell, Defender, RDP and Sysmon, with ATT&CK mappings.
- Photo metadata viewer & removerSee the hidden data in a photo, including GPS location, camera, serial number and dates, and download a clean copy without it. JPEG, PNG and WebP. Photos never leave your device.
- QR code safety checkerUpload or paste a QR code to see where it really leads, without opening it. Spots fake login and payment pages, lookalike domains, link shorteners, Wi-Fi and crypto payment tricks. Nothing is uploaded.
- SPF, DMARC & DKIM checkerLook up a domain's SPF, DMARC and DKIM records and see what's wrong: too many SPF lookups, +all, missing or monitor-only DMARC, no reports, weak DKIM keys, with plain-English fixes.
- SPF & DMARC record generatorBuild a valid SPF record from your email providers and servers, and a DMARC record with the right policy and reporting addresses, ready to paste into your DNS.