Check pasted response headers for XSS-relevant protections — Content-Security-Policy, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, and X-XSS-Protection presence, locally in your browser.
Content reviewed October 2026 · About Toolzum
Run an HTTP security probe on a live URL — reachability, redirect chain, and visible response details, plus a reference checklist for HSTS, X-Frame-Options, and CSP.
Validate Content Security Policy headers against W3C spec and common pitfalls. Code never leaves your device — formatting and validation run locally in your browser.
Analyze HTTP request and response headers — detect security headers, review formatting, and inspect value structure. Code never leaves your device — formatting and validation run locally in your browser.
Generates a browser extension that captures browser tabs, full screens, or specific application windows with configurable resolution, frame rate. No signup or account required.
Generates random integers within a user-defined min-max range with optional unique and sorted output. Uses the browser random number generator — fine for games, raffles, and sampling, not for security secrets. Input never leaves your device — everything runs locally in your browser.
Header presence only: CSP, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, and X-XSS-Protection (deprecated but harmless). No payloads are sent.
No — presence checks catch missing headers, not logic flaws or stored XSS. CSP with strict script-src plus context-aware output encoding is the real fix; this is a checklist.
Any response headers you paste — typically your own app's. Nothing is fetched or probed over the network.
No — header checking runs locally in your browser, free with no signup.
SQL Injection Detector
Scan inputs and queries for SQL injection patterns — tautologies, unions, stacked queries. Catch ' OR '1'='1 before attackers do — local pattern matching, free, no signup.
CVE Lookup
Look up CVE vulnerabilities by ID with severity, descriptions, and affected products. Check CVE-2024-3094 before patching decisions — live OSV data, free, no signup.