Free tools · 24 checks
Free security tools
Free checks for defenders. Every tool runs in your browser: what you type never reaches Kage servers, and lookups go straight from you to public resolvers, registries and threat feeds.
Microsoft 365 tenant recon
See what anyone can learn about your Microsoft 365 tenant from public data: tenant ID and region, mail flow, DKIM, device registration and Teams federation, with fixes for the gaps.
Run check
Conditional Access analyser
Paste your Conditional Access policies and get a grade: legacy auth, MFA coverage, admin protection, risk policies, break-glass and risky exclusions. Runs entirely in your browser.
Run check
Security stack fingerprint
See which email platform, email security gateway (Proofpoint, Mimecast, Microsoft and others), identity provider, DNS host, CDN/WAF and SaaS a domain uses, from public DNS alone, with findings for each layer.
Run check
IP risk score
Rates an address from 0 to 100 using Tor relay status, blocklists, Shodan exposure, spam reports and hosting networks, and shows exactly which signals counted.
Run check
Blocklist lookup
Queries seven public DNS blocklists and StopForumSpam for spam, botnet, open-proxy and brute-force reports, with links to look up or request delisting.
Run check
Anonymiser detector
Classifies a connection as Tor, proxy, VPN, datacenter or direct, and suggests how to handle each case in your app.
Run check
What is my IP
Shows your public IP, how risky it looks to fraud filters, and the browser details every site you visit can read.
Run check
Email address validator
Validates syntax, catches typos and throwaway inboxes, flags shared mailboxes and confirms the domain can receive mail.
Run check
Domain trust check
Combines Cloudflare's malware filter, registration age, registry holds and look-alike naming into one risk rating.
Run check
Typosquat finder
Generates look-alike domains for your brand and checks which ones are registered, resolving and mail-capable.
Run check
IP & ASN lookup
Identifies the organisation, network range, country and abuse contact behind any IP address or AS number via RDAP.
Run check
Certificate inspector
Reads the live certificate from transparency logs and checks expiry, issuer, CAA, DNSSEC and HTTPS DNS records.
Run check
Security header grader
Paste a site's response headers and get a grade for CSP, HSTS, framing, cookies and information leaks, with fixes.
Run check
Email security check
Grades SPF, DKIM, DMARC, MTA-STS, TLS-RPT and BIMI for any domain, counts SPF DNS lookups and tells you what to fix.
Run check
Password breach check
Checks whether a password appears in known breach corpora using k-anonymity. The password never leaves your device.
Run check
Subdomain finder
Discovers subdomains from public certificate transparency logs, the same way attackers do reconnaissance.
Run check
DNS lookup
Queries A, AAAA, MX, NS, TXT, CAA, SOA, DS and more over DNS-over-HTTPS, with DNSSEC validation status.
Run check
Phishing URL analyzer
Breaks down a suspicious link and scores it for phishing traits: punycode, IP hosts, brand abuse, shorteners and more.
Run check
Email header analyzer
Parses raw email headers into a hop-by-hop timeline and checks SPF, DKIM, DMARC results and sender alignment.
Run check
IOC extractor & defanger
Pulls IPs, domains, URLs, hashes, emails, CVEs and ATT&CK IDs out of any text, then defangs or refangs them.
Run check
JWT decoder
Decodes JSON Web Tokens, flags risky algorithms and headers, checks expiry and verifies HMAC signatures locally.
Run check
Hash calculator
Computes MD5, SHA-1, SHA-256, SHA-384 and SHA-512 for text or files. Files are hashed locally and never uploaded.
Run check
Password strength & generator
Estimates crack time from entropy and common patterns, and generates strong passwords with your browser's CSPRNG.
Run check
Encoder / decoder
Base64, Base64url, URL, hex, HTML entity and ROT13 encoding and decoding for payload and log analysis.
Run check
No tools match.