Browser-only security analysers

Nine security tools that inspect certificates, email headers, DNS email records, ciphertext, response headers, nmap output, JSON Web Tokens, subnets, and server logs inside your browser. Nothing you paste is sent to this site, and each tool explains how it reached its result.

Try the analysers in the Security Lab

Why I built them

The Security Lab used to include a security headers checker that produced a grade without inspecting a real response. It looked convincing, but it proved nothing. That was the problem I wanted to fix.

I replaced it with tools that perform the analysis in front of you. Paste something you already have, such as a certificate chain, raw email headers, a suspicious string, or a response header block, and the result stays in your browser.

There was another reason to build them. Much of my governance, risk, and compliance work cannot be shared publicly. These tools can be inspected. A security engineer can read the parser, check the scoring, run the tests, and decide whether the work holds up.

One interface, nine tools

Every analyser uses the same shell: an input area, a sample, a verdict, severity-ranked findings, and a Markdown export. The shared shell keeps the experience consistent while each tool handles a different kind of evidence. The first four are described in depth below and embedded here; the five that followed are summarised after them and open in the lab.

X.509 certificate and chain inspector

Paste one or more Privacy-Enhanced Mail (PEM) certificate blocks. The inspector reads the Distinguished Encoding Rules (DER) and Abstract Syntax Notation One (ASN.1) structure without loading a certificate library. It extracts the serial number, issuer, subject, validity period, key details, fingerprints, and the extensions that matter during a certificate review.

It also tries to build the chain. Authority Key Identifier and Subject Key Identifier values connect each certificate to its issuer, then WebCrypto verifies supported signatures. That currently covers RSA PKCS #1 v1.5 and Elliptic Curve Digital Signature Algorithm (ECDSA) signatures on P-256 and P-384. Unsupported algorithms are labelled as not verified in the browser, never passed by assumption.

The findings call out expired certificates, weak keys, SHA-1 or MD5 signatures, missing Subject Alternative Names, incorrect certificate authority flags, and incomplete or badly ordered chains. It does not decide whether your operating system trusts the root because the tool has no bundled trust store.

Email Header Analyser

Paste the raw headers from an email. The analyser unfolds the header block and rebuilds the Received path from the oldest hop to the newest. Each hop shows timing, protocol, Transport Layer Security (TLS) use, and private, loopback, or link-local IPv4 addresses.

Sender Policy Framework (SPF), DomainKeys Identified Mail (DKIM), and Domain-based Message Authentication, Reporting, and Conformance (DMARC) results come from Authentication-Results. The analyser reports what the receiving server recorded. It does not perform Domain Name System (DNS) lookups or recalculate authentication.

The useful part is comparing identities. It checks From, Return-Path, and Reply-To, then looks for punycode and Cyrillic or Greek characters that resemble Latin letters. The included sample is synthetic and uses reserved domains and addresses, so no real sender or recipient is exposed.

Classical cryptanalysis workbench

Paste an encoded or encrypted string and choose how you want to approach it. Magic mode tries Base64, hexadecimal, binary, decimal, URL encoding, ROT13, ROT47, and reversal in layers. It scores each candidate and shows the path it followed. If no result is convincing, it says so.

The workbench also handles classical ciphers directly. It ranks Caesar shifts with chi-squared scoring, tests Atbash, estimates Vigenère key lengths with Kasiski examination and index of coincidence, and recovers each Vigenère column against English letter frequencies. Single-byte and repeating-key XOR, rail fence, and bounded columnar transposition are included as well.

The statistics behind each candidate are shown beside the output, and the full scoring is in the source. You can inspect the arithmetic instead of accepting a decoded string because it looks plausible.

Security header and Content Security Policy evaluator

Paste the output from curl -sI or a Content Security Policy (CSP) value. The evaluator parses the policy, applies default-src fallbacks, and checks the controls I look for during a header review. These include unsafe script sources, framing restrictions, HTTP Strict Transport Security (HSTS), MIME sniffing protection, referrer policy, cookie flags, and risky Cross-Origin Resource Sharing (CORS) combinations.

The grade follows a fixed rubric printed inside the tool. It starts at 100 and subtracts points by severity: 30 for CRITICAL, 15 for HIGH, and 7 for WARN. This is my rubric, not Mozilla Observatory’s. Each rubric item is charged once, and the score stops at zero. The result also includes a suggested header block you can adapt.

The loaded sample contains this site’s own response headers, and the evaluator gives them a C. The largest deduction is unsafe-inline in script-src, which sits in the header my host serves. Since September 2026 the page itself carries a second policy in a meta tag: inline scripts on public pages are allowed by their SHA-256 hash and unsafe-inline is gone from that policy’s script-src. The sample is captured with a HEAD request, which sees the header and not the page, so the C stands. Publishing the grade the tool produces matters more than giving my own site a convenient exception.

The five that followed

Each of these keeps the same contract: paste what you already have, get a verdict with its reasoning, send nothing anywhere.

Nmap Output Analyser. Reads normal, grepable, and XML nmap output and reports exposure, potentially risky services, and possible end-of-support platforms, with NCA ECC-2:2024 references offered as suggestions. It uses the versions nmap printed and never claims a CVE. No scan runs from the page.

Email DNS Record Checker. Grades pasted SPF, DKIM, and DMARC records: SPF term grammar and the top-level lookup count, RSA DKIM key size, DMARC policy and subdomain inheritance, per owner domain. It makes no DNS queries and does not follow include: targets, so it grades the records you give it, not the ones a receiver would resolve.

JWT Decoder. Decodes the header and claims and flags alg: none, a missing or passed expiry, and missing or malformed issuer and audience claims. It does not verify the signature or compare issuer and audience with expected values; that needs the HMAC secret or the issuer’s public key, and the tool says so instead of guessing.

Subnet Calculator. Network, broadcast, usable range, masks, and the binary split for one IPv4 address in CIDR form, with the range classified against the IANA special-purpose registry.

Log Pattern Checker. Runs six detection patterns over the first 2 KB of each pasted SSH or web log line, correlates failed logins per source address, and lists activity by IP. No matches does not mean safe, and the tool’s scope note says so.

Design decisions

The analysis stays in the browser. The tools have no analysis endpoint, proxy, fetch(), XMLHttpRequest, or sendBeacon call. You can inspect a client certificate or real email headers without sending them to me.

The parsing code is part of the proof. I wrote the DER reader, frequency analysis, CSP parser, and nmap XML tokenizer without third-party JavaScript. A library would reduce the code, but it would also hide the part I wanted peers to inspect.

Hostile input is rendered as text. Results are created with createElement and textContent. The analyser directory contains no innerHTML, so pasted input cannot become executable markup through the results view.

Expensive work has limits. Input is capped at 256 KB. A paste can contain up to ten certificates, repeating XOR keys are tested to a maximum length of 40 over the first 8 KB of input, columnar transposition stops at key length six over the first 4 KB, and nmap parsing stops at 200 hosts and says so. Those boundaries keep the work suitable for a browser tab.

Clear limits

These are analysis tools, not scanners. They do not connect to a host, fetch a certificate, probe a website, or perform DNS queries. You bring the evidence you want to inspect.

The certificate inspector checks chain consistency and supported signatures, but not trust against an operating system root store. The email analyser reports recorded authentication and identity mismatches, but it does not declare that a message is phishing. The header grade is a transparent local rubric, not a replacement for Mozilla Observatory or Security Headers. The log checker matches patterns; an unmatched line is unchecked, not clean.

The certificate and header samples are dated snapshots of this site. A weekly job refreshes them, and the interface shows the capture date so the sample is not mistaken for a live request.

Tested, not claimed

The analysers ship with a Node test suite written with plain assertions: certificate fixtures, WebCrypto signature verification, tampered signatures, spoofed email headers, DNS record grammar, cryptanalysis round trips, the CSP scoring rules, nmap parsers, and log correlation. The suite started at 67 tests with the first four tools; the lab’s shared runner stood at 533 tests in September 2026, 484 of them for the analysers. It runs before every deployment, and outside reviews of the tools feed the next release.

The implementation is ES5 JavaScript with no bundler or runtime dependency. Each analyser has its own file under js/analysers/, alongside the shared shell. The WordPress integration lives in inc/security-lab/analysers.php.

The analysers are one of four groups in the Security Lab, next to the governance artifacts, the investigation workspaces, and the teaching demos.