Tool disclaimer
Last reviewed:
Last updated:
The free tools on endpointcheck.dev are useful and they are limited. This page is explicit about the limits, because the failure mode of a tool that says "everything looks fine" is someone treating that as a security assessment.
The general limits
- They check one narrow thing. Each tool performs a specific check against a specific set of rules. That is all it does.
- A clean result is not a clean bill of health. "No issues found" means the checked property was correct. It does not mean your system is secure.
- They do not test a live system. Every tool analyses input you paste in. None of them scan a target host, and none of them make outbound requests to a URL you supply.
- They do not replace a professional assessment. A tool is not a penetration test, a compliance audit, or a substitute for an experienced reviewer.
- They can be wrong. Checks are based on known rules and common configurations. Context matters, and a tool does not have it.
Tool-by-tool limits
Security headers checker
Reads the headers of a response you paste and compares them against a recommended baseline. It cannot see headers that were stripped in transit. It does inspect a Content-Security-Policy for the usual ways a policy is neutered — 'unsafe-inline', 'unsafe-eval' and a wildcard source — but it cannot tell you whether the sources a policy allows are the ones your application actually needs, or whether a policy is enforced rather than report-only.
CORS tester
Evaluates the Access-Control-* headers of a response you paste against the origin, methods, and headers you specify. It does not perform a live preflight against a server, so it cannot detect server-side behaviour that differs from what the response advertises.
JWT decoder
Decodes the header and payload of a JWT. It does not verify the signature — that would require your key, and sending your key to a webpage is exactly the thing you should not do. A decoded token proves nothing about authenticity. Tokens are processed in your browser and are never transmitted or stored.
OpenAPI security linter
Lints an OpenAPI document you choose from your device, entirely in your browser. It reads the spec as written; it cannot see the routes your server actually exposes, which frequently differ from the documented ones.
Privacy
Input pasted into these tools is processed by JavaScript running in your browser. It is not transmitted to a server, not logged, and not stored. If your browser or an extension intercepts page content, that is outside our control.
No liability
To the fullest extent permitted by law, EndpointCheck and Paolo Rechia are not liable for any loss arising from your use of the tools or reliance on their output. The terms of use apply.
Reporting a problem
If a tool gives a wrong answer, emailprivacy@endpointcheck.dev with the input and the result. Corrections are welcome and get published.