Every header your browser sends with each request — visible to every web server you visit.

WebRTC can reveal your real IP even through a VPN. This checks what IPs your browser exposes via ICE candidates.

Query any DNS record type via Google's public resolver (dns.google).

Look up the hostname for an IP address using PTR records.

Fetch the response headers from any URL. Debug cache, CORS, security headers, redirects, and server config.

Registration and network data for domains and IP addresses via RDAP.

Cryptographically secure passwords generated server-side at the network edge using crypto.getRandomValues().

What your browser reveals to every website you visit — user agent, screen, hardware, and more.

Check if a domain is registered and see its registration details via RDAP.

Check if an email domain has MX, SPF, and DMARC records correctly configured.

Compare your browser's GPS location to what websites infer from your IP address — and see how far off IP geolocation really is.

Follow every redirect hop from a URL and see the full chain — useful for debugging link shorteners, HTTPS upgrades, and CDN routing.

View SSL/TLS certificates logged for a domain via certificate transparency logs (crt.sh). Useful for auditing issued certs and finding subdomains.

Decode, verify, and sign JSON Web Tokens. Everything runs in your browser — no token ever leaves this page.

Look up an Autonomous System Number — the network operator behind a block of IP space — via RDAP.

Fetch a URL and grade its HTTP security headers A–F — HSTS, CSP, X-Frame-Options, and more.

Enter an IPv4 address in CIDR notation to compute the network, broadcast, mask, and usable host range. Runs entirely in your browser.

Compute SHA-1, SHA-256, and SHA-512 digests of any text via the Web Crypto API — nothing leaves your browser.

Base64 and URL encoding/decoding, in-browser. Type in either box.

Break your browser's User-Agent string into browser, engine, OS, and device — parsed locally.