tamper[box]

Web security & TLS tools

Inspect transport, certificate and browser-policy evidence with clear limits. A certificate handshake and a security-header grade test different properties; neither is a complete security audit. Supported paste modes analyze the supplied text locally.

Choose a check

Start with the SSL Certificate Checker for expiry, hostname or chain errors. Compare TLSA records with DANE and inspect hybrid key exchange separately. Use Security Headers and Mixed Content checks for browser protections, and publish a current security.txt so researchers can find the reporting policy.

Tools in this collection

  • DANE & TLSA Checker

    Runs on server
    • Changed a server certificate? Check that its DNS fingerprint still matches.
    • Renewed a certificate? Check TLSA records still match.
    • Running mail with DANE? Check each MX server.
    • See the certificate each server presents next to its TLSA record.
    • Mail delivery failing to you? Rule out a DANE mismatch.

    Check that each server’s TLSA record matches the certificate it presents.

    • Find browser protections your website may be missing.
    • Grade your site's security headers from A+ to F.
    • No Content-Security-Policy yet? See what to add.
    • Get the exact lines to fix each header.
    • Pen test flagged headers? Check the fix is live.

    Grade a site's security headers from A+ to F, with the exact lines that fix them.

    • A certificate warning or renewal coming up? Check what your server presents.
    • Certificate expiring soon? Check the exact date.
    • Browser says not secure? Check the chain and names.
    • Missing intermediate? See which link is absent.
    • Have a PEM file? Decode it and read every field.

    Check a certificate chain: trust, names, expiry, key and the TLS version negotiated.

    • See whether your site can negotiate a post-quantum key exchange.
    • Does your server offer ML-KEM key exchange?
    • Worried about harvest now, decrypt later? Test your site.
    • Enabled X25519MLKEM768? Confirm it negotiates.
    • See configuration guidance for your server.

    Test ML-KEM key exchange from our server and review configuration guidance.

  • security.txt Checker

    Runs on server
    • Help someone who finds a security issue reach the right contact.
    • Publishing a security contact? Validate security.txt.
    • File expired? Check the Expires field.
    • Get a corrected file ready to publish.
    • Check it follows RFC 9116 at /.well-known/.

    Validate security.txt against RFC 9116 and get a corrected file to publish.

    • Moved to HTTPS? Look for insecure resources and cookie settings left behind.
    • Padlock missing? Find http:// resources on the page.
    • Moved to HTTPS? Find images and scripts left behind.
    • Check cookies for Secure, HttpOnly and SameSite.
    • Before a launch, check a page loads nothing insecure.

    Find http:// resources on an HTTPS page and cookies missing Secure, HttpOnly or SameSite.