Four checks that tell you something concrete about your own exposure, and eight everyday analyst utilities. Everything runs on your own machine — nothing is uploaded, nothing is stored, and you never need an account.
Checks the three public DNS records that decide whether a stranger can send email that appears to come from your domain.
We read publicly published DNS records only. Nothing is sent to your servers, nothing is tested, and the domain you enter is not stored.
Paste the full headers of a suspicious message. We show you what the authentication checks actually said, where it really came from, and what does not add up.
Gmail — open the message, click the three dots at top right, then Show original. Copy everything.
Outlook — open the message, File, Properties. Copy the Internet headers box.
Outlook web — three dots, View, View message details.
Everything is parsed in your browser. Nothing is uploaded, logged or transmitted anywhere.
Twelve questions. India's Digital Personal Data Protection Rules were notified in November 2025; core obligations become enforceable in May 2027. There is no small-business exemption.
This is a self-assessment, not a legal opinion. SpiderX Defense is a cybersecurity practice, not a law firm.
Checks a password against billions of credentials exposed in known public breaches. If it appears even once, attackers already have it in their wordlists.
We hash the password in your browser and send only the first five characters of that hash to the lookup service. It returns a list of matches, and the comparison happens here, on your machine. The service never learns your password, and neither do we. This method is called k-anonymity.
Do not test a password you are currently using on a critical account. Test a variation, or change it afterwards.
Generated with your browser’s cryptographic random number generator. Nothing is transmitted, and nothing is remembered once you close the page.
Time to crack offline at 100 billion guesses per second:
A generated password is only useful if you never have to remember it. Store it in a password manager and let that fill it for you. The one password you do memorise — the manager’s master password — is where a long passphrase belongs.
Measures entropy and looks for the structures that appear most often in leaked password datasets. Typed characters stay in this page.
Do not analyse a password you currently use on a critical account. Test a variation instead.
Time to crack offline at 100 billion guesses per second:
This measures how large the search space is. It cannot tell you whether the exact password has already appeared in a breach — a short, common password can have decent entropy on paper and still be cracked instantly because it is already in every wordlist. Check that separately with the password breach check.
Produces the digest of any text. Useful for verifying file integrity, comparing values, and understanding how hashing behaves.
Plain hashes are designed to be fast, which is exactly the wrong property for password storage. Passwords should be stored with a slow, salted algorithm built for the job — bcrypt, scrypt or Argon2. If you find SHA-256 password hashes in an application, that is a finding worth reporting.
Works out which algorithm most likely produced a hash, based on its length, character set and prefix.
This tells you what a hash probably is. It does not reverse it, and we do not host anything that does. Recovering a password from a hash is cracking, and cracking belongs in an authorised engagement on a system you have written permission to test — never on a public web page.
Base64, URL, hexadecimal and ROT13. These are encodings, not encryption — anyone can reverse them, which is precisely why finding secrets stored this way is a finding.
It checks whether the input decodes cleanly as hexadecimal, URL encoding or Base64, and shows the first that works. Some strings are valid in more than one format, so check the result makes sense before relying on it. If nothing decodes, the value may be encrypted or compressed rather than encoded — those cannot be reversed without the key.
Decodes the header and claims of a JSON Web Token so you can read what it actually asserts.
Decoded in your browser. Never paste a live production token into any online tool, including this one — a JWT is a credential.
Enter an address and get the network boundaries. This is the calculation behind every scope document — getting it wrong is how people end up testing systems they were never authorised to touch.
Accepts both directions — CIDR form 192.168.1.130/26 or address and mask 192.168.1.130 255.255.255.192. Either way you get the other.
Version 4 UUIDs from your browser’s cryptographic random source.
Unix timestamps appear in every log file. Convert them to something a human can read.
These are quick indicators, not an assessment. They check public records and pasted text only. They say nothing about your inbound filtering, mailbox security, endpoint protection, or whether someone has registered a lookalike domain. A real assessment looks at all of that.
We are offering a complete email security audit at no cost to the first five businesses that ask. Full findings, a written before-and-after report, and the fix plan — yours to keep whether or not you engage us afterwards.