Free security tools
14 focused checks you can run right now — no account, no limits, no email required. Each one explains what it found in plain English, and what to do about it.
Headers & policies
Security Headers Checker
Check any site’s HTTP security headers and get a plain-English report on what’s missing, weak, or misconfigured.
live checkCSP Checker
Evaluate a Content Security Policy for unsafe directives, wildcard sources and bypasses — from a URL or by pasting the policy.
runs in browserCSP Generator
Build a Content Security Policy directive by directive, with each choice explained as you make it.
live checkCORS Checker
Test how a site responds to cross-origin requests and find out whether its CORS policy is dangerously permissive.
live checkCookie Security Checker
Check the cookies a site sets for Secure, HttpOnly and SameSite, and see exactly what each missing attribute exposes.
live checkSRI Hash Generator
Generate Subresource Integrity hashes for scripts and stylesheets so a compromised CDN can’t silently swap your code.
Transport & DNS
SSL/TLS Checker
Inspect a site’s certificate and TLS configuration — expiry, chain, protocol versions and the weak settings worth fixing.
live checkDNS Security Checker
Check SPF, DMARC, DNSSEC, CAA and MX records for the gaps that let attackers spoof your domain.
live checkSubdomain Checker
Discover a domain’s subdomains from certificate transparency logs and flag the dangling records at risk of takeover.
Tokens & secrets
JWT Decoder
Decode any JSON Web Token to read its header, payload and claims. Nothing is sent anywhere — it decodes in your browser.
runs in browserJWT Security Checker
Check a JSON Web Token for the configuration mistakes that make tokens forgeable — alg confusion, missing expiry, leaked data.
runs in browserSecret Scanner
Paste code or config to find hardcoded API keys, tokens and private keys before you commit them. Runs entirely in your browser.
Site configuration
These check one thing each. Averto checks everything.
Every tool here looks at a single slice of your attack surface. Averto scans your websites, web apps, code, dependencies, containers, configuration and secrets in one place — then explains every finding the same way these tools do.