Check a few things yourself.
Passive checks you can run on your own domain in a few seconds. No signup, no email wall, nothing stored. If they turn something up and you want a hand fixing it, you know where to find me.
Can someone send email as you?
Checks SPF, DKIM and DMARC and tells you, in plain English, whether anyone can forge mail from your domain. Most companies fail this.
What the internet can see
Finds every subdomain ever issued a certificate from public transparency logs, checks which still resolve, and flags the ones whose names suggest admin panels or forgotten staging environments.
DNS hygiene
CAA, DNSSEC, nameserver resilience, wildcard records, and dangling CNAMEs pointing at services that no longer exist — the precondition for subdomain takeover.
TLS configuration
Which protocol versions and ciphers your server still negotiates, whether the certificate chain validates, and how long before it expires. A padlock says none of this.
Security headers checker
Grades your HTTP response headers — CSP, HSTS, frame protection and more — and gives you the exact values to set.
JWT decoder
Read a JSON Web Token's claims with the expiry as a real date, and the usual mistakes flagged — alg:none, no expiry, lifetimes measured in months. Runs in your browser; the token never leaves the page.
CVSS 3.1 calculator
Base score and vector string, implemented against the specification including the round-up rule most calculators get wrong — with an honest note on where CVSS stops helping.
Hash identifier
What format is this hash? Where several share a shape, all are listed rather than guessing — a confident wrong answer costs hours.
Every result comes with the exact fix, and you are welcome to take it and do nothing else — that is genuinely the point of publishing these. If you would rather someone else did it, there are fixed-price fixes from ₹6,000, scoped tightly enough to quote without a call. If a check comes back clean, nothing is offered, because there would be nothing to sell.
Everything here is passive: public DNS lookups and a single HTTP request for response headers. Nothing is scanned, no payloads are sent, no response bodies are read, and no results are stored or logged against you. The endpoints validate every target against private address ranges before connecting, because a tool that fetches user-supplied URLs is an SSRF vector and it would be embarrassing to get that wrong here of all places.