Four checks that tell you something concrete about your own exposure, and eleven everyday analyst utilities. Everything runs on your own machine — nothing is uploaded, nothing is stored, and you never need an account.
Checks the three public DNS records that decide whether a stranger can send email that appears to come from your domain.
We read publicly published DNS records only. Nothing is sent to your servers, nothing is tested, and the domain you enter is not stored.
Paste the full headers of a suspicious message. We show you what the authentication checks actually said, where it really came from, and what does not add up.
Gmail — open the message, click the three dots at top right, then Show original. Copy everything.
Outlook — open the message, File, Properties. Copy the Internet headers box.
Outlook web — three dots, View, View message details.
Everything is parsed in your browser. Nothing is uploaded, logged or transmitted anywhere.
Twelve questions. India's Digital Personal Data Protection Rules were notified in November 2025; core obligations become enforceable in May 2027. There is no small-business exemption.
This is a self-assessment, not a legal opinion. SpiderX Defense is a cybersecurity practice, not a law firm.
Checks a password against billions of credentials exposed in known public breaches. If it appears even once, attackers already have it in their wordlists.
We hash the password in your browser and send only the first five characters of that hash to the lookup service. It returns a list of matches, and the comparison happens here, on your machine. The service never learns your password, and neither do we. This method is called k-anonymity.
Do not test a password you are currently using on a critical account. Test a variation, or change it afterwards.
Paste a link from a message you were not expecting. We pull it apart and show you the tricks attackers hide inside a URL — look-alike characters, the real domain buried in a subdomain, and the rest.
Nothing is opened, requested or sent anywhere. The link is taken apart as text inside your browser — which is exactly why it is safe to paste something you would never click.
We never follow the link, so a shortener’s real destination stays hidden, and a clean-looking URL can still serve a malicious page. This shows you the structural tricks only. When the structure looks fine but the message still feels wrong, trust that feeling.
Every finding in a penetration test report needs a severity, and “high” is not a severity until you can show how you got there. Set the eight base metrics and you get the score, the rating and the vector string to paste into your report.
CVSS measures the vulnerability in isolation. It knows nothing about whether the affected system holds real customer data or sits on an isolated test network. Put the vector string in your report so the reader can see your reasoning — and say plainly where you think the environment makes it worse or better than the number suggests.
The spoofing check tells you what is missing. This builds what you need to publish. Tick the services that send mail as your domain, choose how strict you want to be, and copy the two DNS records out.
Publish p=none first and read the reports for two to four weeks. They will show you senders you had forgotten about — the invoicing tool, the CRM, the booking system. Move to quarantine, then reject, only once every legitimate sender is accounted for. Going straight to reject is how a business silently stops receiving its own invoices.
DKIM needs a key pair, and the private half must live with your mail provider — never generated in a web page. Google Workspace, Microsoft 365 and Zoho all generate it for you in their admin console and hand you the public record to publish. Do that after these two are live.
Generated with your browser’s cryptographic random number generator. Nothing is transmitted, and nothing is remembered once you close the page.
Time to crack offline at 100 billion guesses per second:
A generated password is only useful if you never have to remember it. Store it in a password manager and let that fill it for you. The one password you do memorise — the manager’s master password — is where a long passphrase belongs.
Measures entropy and looks for the structures that appear most often in leaked password datasets. Typed characters stay in this page.
Do not analyse a password you currently use on a critical account. Test a variation instead.
Time to crack offline at 100 billion guesses per second:
This measures how large the search space is. It cannot tell you whether the exact password has already appeared in a breach — a short, common password can have decent entropy on paper and still be cracked instantly because it is already in every wordlist. Check that separately with the password breach check.
Produces the digest of any text. Useful for verifying file integrity, comparing values, and understanding how hashing behaves.
Plain hashes are designed to be fast, which is exactly the wrong property for password storage. Passwords should be stored with a slow, salted algorithm built for the job — bcrypt, scrypt or Argon2. If you find SHA-256 password hashes in an application, that is a finding worth reporting.
Works out which algorithm most likely produced a hash, based on its length, character set and prefix.
This tells you what a hash probably is. It does not reverse it, and we do not host anything that does. Recovering a password from a hash is cracking, and cracking belongs in an authorised engagement on a system you have written permission to test — never on a public web page.
Base64, URL, hexadecimal and ROT13. These are encodings, not encryption — anyone can reverse them, which is precisely why finding secrets stored this way is a finding.
It checks whether the input decodes cleanly as hexadecimal, URL encoding or Base64, and shows the first that works. Some strings are valid in more than one format, so check the result makes sense before relying on it. If nothing decodes, the value may be encrypted or compressed rather than encoded — those cannot be reversed without the key.
Decodes the header and claims of a JSON Web Token so you can read what it actually asserts.
Decoded in your browser. Never paste a live production token into any online tool, including this one — a JWT is a credential.
Enter an address and get the network boundaries. This is the calculation behind every scope document — getting it wrong is how people end up testing systems they were never authorised to touch.
Accepts both directions — CIDR form 192.168.1.130/26 or address and mask 192.168.1.130 255.255.255.192. Either way you get the other.
Version 4 UUIDs from your browser’s cryptographic random source.
Unix timestamps appear in every log file. Convert them to something a human can read.
Is this name registered, who registered it, and when does it expire? Reads the public RDAP record — the modern, structured replacement for WHOIS.
Queried live from the public RDAP registry from your own browser. Most registrars redact the registrant’s personal details for privacy — when they do, you will see the registrar and the dates rather than a name.
A domain registered three days ago that impersonates a well-known brand is one of the strongest phishing signals there is. Creation date alone often tells you more than the content of the email.
Who owns this address? Returns the network allocation, the organisation it is assigned to, and the country of registration for any IPv4 or IPv6 address.
Reads the public RDAP allocation record from the regional internet registry. This gives you the owning organisation and network range — it is registry data, not street-level geolocation, and private ranges have no public record.
When you pull a sending IP out of an email header, this tells you whether it belongs to the service the mail claims to come from, or to a hosting provider on the other side of the world.
Read any record type published for a domain. The same DNS-over-HTTPS resolver the spoofing check uses, but with the raw answers shown to you.
Resolved through Cloudflare’s public DNS-over-HTTPS endpoint from your browser. Only the domain name you type is sent, and nothing is stored.
MX shows who handles the domain’s mail. TXT is where SPF and DMARC live. NS tells you who controls the zone — if that changes unexpectedly, treat it as an incident.
These are quick indicators, not an assessment. They check public records and pasted text only. They say nothing about your inbound filtering, mailbox security, endpoint protection, or whether someone has registered a lookalike domain. A real assessment looks at all of that.
We are offering a complete email security audit at no cost to the first five businesses that ask. Full findings, a written before-and-after report, and the fix plan — yours to keep whether or not you engage us afterwards.