Scan inputs and queries for SQL injection patterns — tautologies, unions, stacked queries. Catch ' OR '1'='1 before attackers do — local pattern matching, free, no signup.
Content reviewed October 2026 · About Toolzum
Formats SQL queries with proper keyword capitalization, indentation, and clause alignment for readable database operations.
Decode QR codes from uploaded images. Scan any QR code image and extract the embedded text or URL. Point it at screenshots, photos, or documents — decoded URLs and text copy out instantly. Runs locally, free, no signup.
Check SSL/TLS certificate details for any domain via public certificate APIs. View issuer, validity period, days remaining, and SANs. Expiry alerts catch outages before users do — free, no signup.
Catch grammar, spelling, and punctuation errors with in-browser pattern matching — homophones, run-ons, misplaced commas. Writers proofread a 1,000-word draft in seconds — runs locally, free to start with fair limits.
Scan and clear cookies, localStorage, and sessionStorage for the current site — see what's stored first. Audit privacy trackers before wiping — local inspection, free, no signup.
Tautologies (' OR '1'='1), UNION selects, stacked queries (; DROP), comment truncations (--), and time-based payloads (SLEEP/WAITFOR). Each flag names the technique.
No — pattern scanning catches known shapes, not logic flaws or second-order injection. Parameterized queries plus least-privilege DB users are the real fix; this is a tripwire.
Yes on prose containing quotes and SQL keywords (O'Brien, 'select committee'). Review flags in context — legitimate text trips naive patterns.
No — matching runs locally in your browser. Inputs never leave your device.
XSS Protection Checker
Check pasted response headers for XSS-relevant protections — Content-Security-Policy, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, and X-XSS-Protection presence, locally in your browser.
Secret Scanner
Scan text and code for leaked secrets and credentials. Detects Stripe keys, GitHub tokens, Slack tokens, Google API keys, AWS keys, OpenAI keys, JWT tokens, private keys, and config passwords.