Browser-only security analysers

Four security tools that inspect certificates, email headers, ciphertext, and response headers inside your browser. Nothing you paste is sent to this site, and each tool explains how it reached its result.

Update, September 2026: the original four have grown to nine. The Security Lab now also analyses nmap output, DNS email-authentication records (SPF, DKIM, DMARC), JWTs, subnets, and server logs. The account below documents the original four and still describes how all nine work.

Try the analysers in the Security Lab

Why I built them

The Security Lab used to include a security headers checker that produced a grade without inspecting a real response. It looked convincing, but it proved nothing. That was the problem I wanted to fix.

I replaced it with four tools that perform the analysis in front of you. Paste something you already have, such as a certificate chain, raw email headers, a suspicious string, or a response header block, and the result stays in your browser.

There was another reason to build them. Much of my governance, risk, and compliance work cannot be shared publicly. These tools can be inspected. A security engineer can read the parser, check the scoring, run the tests, and decide whether the work holds up.

The original four, one interface

All four analysers use the same interface: an input area, a sample, a verdict, severity-ranked findings, and a Markdown export. The shared shell keeps the experience consistent while each tool handles a different kind of evidence.

X.509 certificate and chain inspector

Paste one or more Privacy-Enhanced Mail (PEM) certificate blocks. The inspector reads the Distinguished Encoding Rules (DER) and Abstract Syntax Notation One (ASN.1) structure without loading a certificate library. It extracts the serial number, issuer, subject, validity period, key details, fingerprints, and the extensions that matter during a certificate review.

It also tries to build the chain. Authority Key Identifier and Subject Key Identifier values connect each certificate to its issuer, then WebCrypto verifies supported signatures. That currently covers RSA PKCS #1 v1.5 and Elliptic Curve Digital Signature Algorithm (ECDSA) signatures on P-256 and P-384. Unsupported algorithms are labelled as not verified in the browser, never passed by assumption.

The findings call out expired certificates, weak keys, SHA-1 or MD5 signatures, missing Subject Alternative Names, incorrect certificate authority flags, and incomplete or badly ordered chains. It does not decide whether your operating system trusts the root because the tool has no bundled trust store.

Email Header Analyser

Paste the raw headers from an email. The analyser unfolds the header block and rebuilds the Received path from the oldest hop to the newest. Each hop shows timing, protocol, Transport Layer Security (TLS) use, and private or reserved addresses.

Sender Policy Framework (SPF), DomainKeys Identified Mail (DKIM), and Domain-based Message Authentication, Reporting, and Conformance (DMARC) results come from Authentication-Results. The analyser reports what the receiving server recorded. It does not perform Domain Name System (DNS) lookups or recalculate authentication.

The useful part is comparing identities. It checks From, Return-Path, and Reply-To, then looks for punycode and Cyrillic or Greek characters that resemble Latin letters. The included sample is synthetic and uses reserved domains and addresses, so no real sender or recipient is exposed.

Classical cryptanalysis workbench

Paste an encoded or encrypted string and choose how you want to approach it. Magic mode tries Base64, hexadecimal, binary, decimal, URL encoding, ROT13, ROT47, and reversal in layers. It scores each candidate and shows the path it followed. If no result is convincing, it says so.

The workbench also handles classical ciphers directly. It ranks Caesar shifts with chi-squared scoring, tests Atbash, estimates Vigenère key lengths with Kasiski examination and index of coincidence, and recovers each Vigenère column against English letter frequencies. Single-byte and repeating-key XOR, rail fence, and bounded columnar transposition are included as well.

The scores stay visible beside the output. You can inspect the arithmetic instead of accepting a decoded string because it looks plausible.

Security header and Content Security Policy evaluator

Paste the output from curl -sI or a Content Security Policy (CSP) value. The evaluator parses the policy, applies default-src fallbacks, and checks the controls I look for during a header review. These include unsafe script sources, framing restrictions, HTTP Strict Transport Security (HSTS), MIME sniffing protection, referrer policy, cookie flags, and risky Cross-Origin Resource Sharing (CORS) combinations.

The grade follows a fixed rubric printed inside the tool. It starts at 100 and subtracts points by severity: 30 for CRITICAL, 15 for HIGH, and 7 for WARN. This is my rubric, not Mozilla Observatory’s. The result also includes a corrected header block you can copy and adapt.

The loaded sample contains this site’s own headers, and the evaluator gives them a C. The main reason is unsafe-inline in script-src, which the current Elementor and theme setup still needs. Publishing that result matters more than giving my own site a convenient exception.

Design decisions

The analysis stays in the browser. The tools have no analysis endpoint, proxy, fetch(), XMLHttpRequest, or sendBeacon call. You can inspect a client certificate or real email headers without sending them to me.

The parsing code is part of the proof. I wrote the DER reader, frequency analysis, and CSP parser without third-party JavaScript. A library would reduce the code, but it would also hide the part I wanted peers to inspect.

Hostile input is rendered as text. Results are created with createElement and textContent. The analyser directory contains no innerHTML, so pasted input cannot become executable markup through the results view.

Expensive work has limits. Input is capped at 256 KB. A paste can contain up to ten certificates, repeating XOR keys are tested to a maximum length of 40, and columnar transposition stops at key length seven. Those boundaries keep the work suitable for a browser tab.

Clear limits

These are analysis tools, not scanners. They do not connect to a host, fetch a certificate, probe a website, or perform DNS queries. You bring the evidence you want to inspect.

The certificate inspector checks chain consistency and supported signatures, but not trust against an operating system root store. The email analyser reports recorded authentication and identity mismatches, but it does not declare that a message is phishing. The header grade is a transparent local rubric, not a replacement for Mozilla Observatory or Security Headers.

The certificate and header samples are dated snapshots of this site. A weekly job refreshes them, and the interface shows the capture date so the sample is not mistaken for a live request.

Tested, not claimed

At publication the suite had 67 tests, running under Node with plain assertions. It covers certificate fixtures, WebCrypto signature verification, tampered signatures, spoofed email headers, cryptanalysis round trips, and the CSP scoring rules. All 67 passed. The suite has since grown to 164 tests as the five later analysers landed.

The implementation is ES5 JavaScript with no bundler or runtime dependency. Each analyser has its own file under js/analysers/, alongside the shared shell. The WordPress integration lives in inc/security-lab/analysers.php.

All nine analysers, the original four and the five added since, are available in the Security Lab.