Free tools
API security tools that run in your browser
Four small analysers for the mistakes that are easy to make and easy to miss. Paste something in, read the result, close the tab. No account, no upload, nothing stored.
Security headers checker
Paste a raw HTTP response and get a pass/fail breakdown of the security headers that matter, with the exact header value that was checked.
HSTS, CSP, X-Content-Type-Options, Referrer-Policy, frame options and more.
CORS tester
Check a CORS preflight or actual response against the origin, methods and headers you specify.
Reads Access-Control-* headers and flags wildcard-with-credentials and origin-reflection issues.
JWT decoder
Decode the header and payload of a JSON Web Token and see the claims, expiry and algorithm at a glance.
Fully client-side. Tokens are never transmitted or stored.
OpenAPI security linter
Lint an OpenAPI 3 document for missing security schemes, operations that inherit no auth, and other spec-level security gaps.
Runs entirely in your browser against a file you choose.
These are not a security assessment
Each tool checks one narrow thing well. They do not scan your API, they do not cover every vulnerability class, and a clean result means the specific check passed — nothing more. Read thetool disclaimer for the full limits.
About the tools
Do these tools send my data anywhere?
No. Every tool here runs as JavaScript inside your browser. What you paste is read by the page and never transmitted to a server. There is no upload step, no account, and no database behind these pages.
Do the tools send requests to the API I paste in?
No. The tools read the responses you give them. They do not scan a target host, and they will not make requests to a URL you type in. That is a deliberate limit: scanning a third-party system without permission is not something a copy-paste tool should do.
Are these a replacement for a security scanner?
No. They check specific, well-understood misconfigurations quickly. They do not cover the full vulnerability surface of an API, and a clean result is not evidence that an API is secure.
Is there a limit on how much I can use them?
No. No account, no rate limit, no cap. They are static pages served from a CDN.
Are you going to add more tools?
Possibly. The current set was chosen because each one catches a misconfiguration that is easy to make and easy to miss. Whether more get added depends on what proves genuinely useful.