Free Security Tools Online: SSL, PKCE, XSS, IP
Security work fails quietly. An expired certificate, a stolen token, a script tag slipped into user input — none of them announce themselves until something breaks or leaks. This category collects five browser-based tools for the day-to-day: certificate verification, IP intelligence, OAuth PKCE generation, HTML sanitization, and privacy policy drafting. All five run entirely client-side, and that architecture is not a bonus — it is the point. Security workflows touch passwords, private keys, session tokens, and code verifiers. Paste any of those into a tool that phones home to a server and you have handed your secret to a stranger. Every tool on this page computes inside your browser tab: your machine's CPU, your memory, nothing else. No request carries your input anywhere, which is what makes these tools usable on real data instead of toy examples.
When to Use Each Tool
Network and Certificate Diagnostics
Use the SSL Checker to verify any website's certificate without opening devtools. It reports validity, issuer, expiration date, and configuration problems in one pass. Check your own domain right after deploying a renewed certificate, and check third-party domains before you wire them into production integrations. A certificate that expires in three days is a 3 a.m. outage waiting to happen, and a hostname mismatch is a man-in-the-middle warning dressed as a browser error.
Use the IP Address Lookup to map any IP address to its geolocation, ISP, and network details. Typical cases: triaging a suspicious login attempt in server logs, confirming where an API call actually originates, or spotting the VPN or hosting provider behind an address. The lookup returns enough network context to decide whether an address deserves a block, a watch rule, or nothing at all.
Authentication Development
Use the PKCE Auth Code Generator when building OAuth 2.0 authorization code flows for public clients — single-page apps, mobile apps, CLI tools. It generates RFC 7636-compliant code verifiers and their S256 challenge pairs instantly, and it works completely offline. Because the verifier never leaves your machine, you can drop the output straight into manual token-flow testing without worrying that the value you are about to trade for an access token was observed by anyone else.
Input Security
Use the HTML Sanitizer on any user-supplied HTML you plan to render. It strips dangerous elements and attributes — script tags, inline event handlers, javascript: URLs — and returns clean markup you can store or display. Run every rich-text input path through it before shipping, and treat the cleaned output as the version of record. Unsanitized user HTML is still the most common cross-site scripting vector on the web.
Compliance
Use the Privacy Policy Generator to draft a starting privacy policy for your website or app. The generation engine runs entirely locally, so the product details you enter are never logged on a server. Treat the output as a first draft rather than legal advice: review it against the data you actually collect, have counsel check it, then publish it and link it from your footer.
Workflow
A typical security pass over a web project looks like this:
- Build the auth flow locally. Generate a PKCE verifier and challenge pair, wire them into your OAuth client, and test the token exchange by hand before any code review.
- Sanitize every input path. Push sample user HTML through the sanitizer and confirm the cleaned output renders with no scripts, handlers, or data-exfiltrating URLs.
- Verify the certificate. After deploy, run the SSL checker against your domain and confirm the chain, validity window, and hostname all line up.
- Watch the traffic. When a request in the logs looks odd, run its source IP through the lookup before deciding to block it — context beats reflex.
- Publish the legal layer. Generate the privacy policy, review it against your real data flows, and link it from every page.
Each step uses a different tool, and none of them require an account, an API key, or a server round-trip carrying your data.
Zero-Knowledge by Design
A security tool that uploads your data is worse than no tool at all — it is a leak you installed yourself. When a web service accepts a token or key and forwards it to a backend, you cannot verify what gets logged, cached, or resold. Client-side execution removes the question entirely: your input is processed by JavaScript in your own tab and nowhere else, and the guarantee is structural rather than promised.
Related Tools
Related Categories
- Dev Tools — JWT decoder, UUID generator and validator, regex tester, and HTML entity encoder for the rest of your secure-coding bench.
- JSON/Data — JSON formatter and Base64 encoder/decoder for inspecting payloads, claims, and encoded credentials.
- Text — Diff checker and word counter for reviewing policy drafts and comparing sanitized output against the original.