$
/api backend against the target you name. Jump to the toolkit.
Type one domain and h4ck0r.com fires every applicable check in the suite at it in parallel —
DNS and DNSSEC, WHOIS/RDAP, TLS certificate and protocol support, HSTS, HTTP security headers,
cookie flags, security.txt, SPF/DKIM/DMARC, mail-transport security, WAF/CDN
detection, technology fingerprinting and certificate-transparency subdomains — then merges
every result into one graded report. Each tile fills in the moment its own request comes back,
and every tile title opens the full tool behind it.
EHLO to its mail servers. The target
logs them. Only sweep systems you own or are explicitly authorised to test. Every endpoint is
rate-limited per IP, one named target at a time — no ranges, no payloads, no exploitation.
Both extras are off by default because they are noisier than the passive checks.
The method probe asks the server which HTTP verbs it accepts (OPTIONS,
TRACE, and PUT/DELETE/PATCH aimed at a random
non-existent filename so nothing real can be written). The exposure check requests a fixed list of
classic accidentally-published paths such as /.git/HEAD and /.env.
Everything else on this page is passive.
Shows the public IP address, network operator and approximate location this browser is reaching the internet from.
Geolocates any public IPv4/IPv6 address and reports its network, organisation and country — useful for triaging log entries.
Resolves an IP or hostname to its ASN, BGP prefix, country, allocation date, and operator name. Sourced from Team Cymru's BGP feed.
Maps an IP address back to its hostname (PTR record). Useful for mail server validation, log analysis, and SOC investigation.
Opens a real TCP connection to each listed port on a single public host and reports open/closed/filtered plus any banner returned.
⚠ Only scan systems you own or are explicitly authorised to test. One named target at a time; requests are rate-limited server-side.
Expands a CIDR block into network address, broadcast, netmask, wildcard, usable host range and host count.
Resolves the OUI prefix of a MAC address to the hardware manufacturer — handy for identifying unknown devices on a network.
Teaching demo only — it renders synthetic packet rows so you can learn how a capture table reads (source, destination, protocol, port, info). No real traffic is captured; browsers cannot access the network interface. For live capture use Wireshark or tcpdump.
Queries live A, AAAA, MX, TXT, NS and CNAME records for a domain straight from the resolver — no browser DNS cache in the way.
Pulls registration data over RDAP: registrar, creation and expiry dates, status codes and nameservers for a domain.
Fetches the live certificate served on port 443 and reports issuer, subject, SANs, validity window and days remaining before expiry.
Visualize and validate a TLS certificate chain. Shows the trust path from leaf to root CA, including intermediate certificates.
Probes the actual server and reports which TLS protocols are supported (TLS 1.0/1.1/1.2/1.3) plus negotiated cert key/sig info.
Paste one or more PEM-encoded X.509 certificates. Parses subject, issuer, validity, key, SANs, fingerprints, and full extension set.
Grade a domain's HTTP security headers. Checks for CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, and more.
Build a secure Content-Security-Policy header interactively. Prevents XSS, clickjacking, and data injection attacks.
Reads the live Strict-Transport-Security header AND queries the Chromium HSTS preload list to see if the domain is hardcoded into browsers.
Send a real HTTP(S) request from the server and see status, full response headers, redirect chain, timing, detected CDN/WAF, and a body preview.
⚠ Only request URLs you own or are authorised to test. Single target per run; requests are rate-limited server-side.
Shows the exact request headers this browser sends — the fingerprint every site you visit receives.
Breaks a User-Agent string down into browser, engine, OS and device — useful for reading access logs and spotting bots.
Pulls real TXT records and parses each email-auth policy. Flags missing DMARC, weak SPF, short DKIM keys.
Hashes text with MD5, SHA-1, SHA-256 or SHA-512 in-browser via WebCrypto — nothing is sent anywhere.
Identify the algorithm of an unknown hash. Supports MD5, SHA-1, SHA-256, SHA-512, bcrypt, NTLM, MySQL, and more.
HMAC over arbitrary data with arbitrary keys. SHA-1/256/384/512. Hex + Base64 + Base64URL output.
Splits a JSON Web Token into header, payload and signature and decodes the claims (including expiry) locally in your browser.
Sign your own HS-family JWTs in-browser via WebCrypto, OR paste a token + secret to cryptographically verify it. Nothing leaves your browser.
Generates random passwords or diceware-style passphrases from crypto.getRandomValues(), with a live entropy estimate.
Measure the Shannon entropy and randomness quality of any string. Essential for evaluating password strength, encryption keys, and random number generators.
Round-trips text through Base64, URL-encoding and hex — the three transforms you hit constantly in payloads, logs and query strings.
Converts a value between binary, octal, decimal and hexadecimal — and shows the ASCII rendering where one exists.
Format / minify / validate JSON. Optional dot-path query for extracting fields. Pretty-printed with stable key sort.
Converts Unix epoch values to human-readable UTC/local dates and back — the fastest way to read a timestamp out of a log line.
Converts a colour between HEX, RGB and HSL with a live preview swatch.
Encodes any text, URL or Wi-Fi string into a QR code rendered locally — nothing is uploaded to a third-party generator.
Enter text and click Generate
Enumerates subdomains via Certificate Transparency logs. Surfaces hostnames that ever had a public TLS cert issued — pre-prod, internal portals, dev environments. Passive: it reads public CT records, it does not touch the target.
Runs a JavaScript regular expression against sample text and lists every match, index and capture group.
Translates a five-field crontab expression into plain English and lists the next scheduled run times.
Splits a URL into scheme, host, port, path, query parameters and fragment, decoding each parameter for you.
Build a copy-pasteable curl command from URL/method/headers/body. Properly escapes single-quoted args.
Compares two blocks of text line by line and highlights what was added, removed or left unchanged.
Generates cryptographically random RFC 4122 version-4 UUIDs, up to 20 at a time.
Produces filler paragraphs, sentences or words for mockups and test fixtures.
Catch 1s (+10) | Avoid 0s (-20) | ⭐ Power-ups!
Resolves every apex record type for a domain in one pass — A, AAAA, NS, SOA, MX, TXT, CAA, DS and DNSKEY — plus the mail and service names that usually hide problems, then grades what it finds. Paste a bare domain or a full URL.
Asks the same question of four independent public resolvers on four different networks at the same time, then diffs the answers. If a change is only half-way out, this is where you see which resolver is still serving the old record.
Reports whether a zone is signed, whether the parent publishes a matching DS record, and whether a validating resolver actually accepts the chain — plus the algorithms in use and how long the current signatures have left.
example.com, not www.example.com.Looks up the PTR name for an address and then resolves that name back again. Receiving mail servers and abuse desks run exactly this check — forward-confirmed reverse DNS (FCrDNS) — and mail from an address whose PTR does not point back at itself is routinely greylisted or rejected. Up to 16 addresses, comma-separated.
Asks a set of well-known public DNS blocklists whether an address is listed, and decodes each operator's return code so you know why. Run it against your own mail server's outbound IP before you wonder where the mail went.
Nearly every real-world TLS outage is a certificate that quietly expired, a chain that was never served, or a cipher suite that should have been retired a decade ago. These four tools cover that ground: one talks to your servers, three work entirely inside this browser page so you can decode keys and certificates without uploading them anywhere.
Opens a real TLS connection to each host, reads the leaf certificate and reports days
remaining, issuer, key type and whether the hostname actually matches. Up to
10 hosts per run — one per line, or comma separated. host:port
is accepted. Press Ctrl+Enter in the box to run.
Paste a cipher suite in either notation — IANA
(TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) or OpenSSL
(ECDHE-RSA-AES128-GCM-SHA256) — and it is broken into key exchange,
authentication, bulk cipher, mode and MAC/PRF, then rated with the reasoning spelled out.
Nothing is sent anywhere; this runs in the page.
Paste one OpenSSH public key line or a whole authorized_keys /
known_hosts file. Each key's base64 blob is parsed on the SSH wire format and
the modern SHA256:… fingerprint is computed with WebCrypto — byte-for-byte
what ssh-keygen -lf prints. Key type and bit size come out of the blob itself.
Press Ctrl+Enter to run. Public keys only; nothing leaves the browser.
Paste a PEM block (CERTIFICATE, CERTIFICATE REQUEST or
PUBLIC KEY) or raw base64 DER. The armour is stripped, the DER is decoded in
this page and walked into a browsable tree — tag, length and value for every element,
with OIDs resolved to names. Certificates also get a plain-language summary above the tree.
Nothing is uploaded: the bytes never leave your browser, which is the
difference between this and the server-side
PEM Certificate Parser —
use that one when you want the server's OpenSSL view, use this one for anything sensitive.
Press Ctrl+Enter to run.
Seven checks that look at how a site actually behaves over HTTP: the cookies it hands out, who it will share responses with, which verbs it accepts, what it is built on, what sits in front of it, what it accidentally leaves readable, and whether it tells you where to report a bug. Everything here is read-only diagnostics — the same class of request a browser or a search-engine crawler makes.
Fetches a URL, collects every Set-Cookie from every redirect hop, and grades each
cookie on Secure, HttpOnly, SameSite, the
__Host-/__Secure- prefix rules and its lifetime.
Cookie values are never sent back to your browser — the server measures the
value's length and discards it, so only the byte count is reported.
Sends the same request with several forged Origin headers — a random third-party
origin, null, the site's own origin and a suffix-match lookalike — then reports
which ones the server was willing to share responses with. A server that reflects any origin
and sets Access-Control-Allow-Credentials: true lets any website read
logged-in users' data.
Asks the server which verbs it accepts, then checks the answer. TRACE and
TRACK echo the request back and enable Cross-Site Tracing; PUT,
DELETE and PATCH are aimed at a random filename that cannot exist,
so a 2xx there proves the server accepts anonymous writes rather than destroying anything real.
Identifies the server, framework, CMS, CDN, analytics and JavaScript libraries behind a page from its response headers, cookie names and HTML markers. Every detection shows the exact string that produced it — nothing is asserted without evidence — and disclosed version numbers are called out separately, because a version number tells an attacker which exploits to try.
Works out which web application firewall, CDN or reverse proxy sits in front of a host — from response headers, cookie names, the CNAME chain and the ASN that owns the answering IP. Completely passive: one ordinary GET plus DNS lookups. No attack payloads are sent, so a quiet or transparent-mode WAF will not show up here.
Requests a fixed list of 28 classic accidental-exposure paths — /.git/HEAD,
/.env, database dumps, backup archives, phpinfo.php, admin consoles —
and reports only the ones whose content proves the file is really there. A soft-404
baseline is measured first, so "200 OK" alone never counts as a hit.
Fetches /.well-known/security.txt and validates it against RFC 9116 — missing
Contact, an expired or absent Expires, the wrong location, plain HTTP
— then summarises robots.txt (highlighting Disallow paths that point
at something sensitive), /.well-known/mta-sts.txt and the other standard
well-known files.
Mail is the only protocol most organisations still run with no default authentication and no default encryption. These tools measure both halves: how mail reaches a domain (MX, STARTTLS, MTA-STS, DANE), who is permitted to send as it (SPF, DMARC), and what a single suspicious message’s headers actually say about where it came from.
Grades a domain’s mail transport security: MX topology, whether each MX actually advertises STARTTLS, plus MTA-STS, TLS-RPT, BIMI and DANE/TLSA on a DNSSEC-signed zone. Connect, EHLO, QUIT — no message is ever sent. Sender authentication (SPF/DKIM/DMARC) is graded separately by the SPF/DKIM/DMARC analyzer.
Paste the raw headers of a suspicious message and get the relay chain in chronological order with per-hop delays, the SPF/DKIM/DMARC verdicts the receiving server recorded, and a list of phishing indicators. The headers never leave this browser — parsing is pure JavaScript in this tab, nothing is uploaded, nothing is stored.
Assembles a syntactically valid v=spf1 record and checks it against the constraints that actually break SPF in production: the RFC 7208 limit of ten DNS-querying mechanisms, the 255-byte DNS string limit, and the one-record-per-domain rule. Everything is computed in this browser.
Ten DNS lookups. RFC 7208 §4.6.4 caps a whole SPF evaluation at ten DNS-querying terms: a, mx, ptr, exists, include and the redirect modifier. The limit counts recursively, so an include: spends its own record's lookups too. Blowing the limit returns permerror, which DMARC treats as an SPF failure — the record breaks delivery for mail that would otherwise have passed. ip4: and ip6: cost nothing, so replacing includes with literal ranges is the standard fix.
255 bytes per DNS string. A TXT record is a sequence of character-strings, each at most 255 bytes (RFC 1035 §3.3.14), concatenated with nothing between them. A longer record is legal but must be published as several quoted strings.
Exactly one record. Two TXT records starting v=spf1 on the same name is a permerror under RFC 7208 §4.5 — receivers do not merge them. Adding a new provider means extending the existing record, never publishing a second one.
SPF authenticates the envelope sender (MAIL FROM), which is not the From: address the recipient sees, and it breaks on forwarding. That gap is what DMARC alignment and DKIM exist to close — see the DMARC builder.
Builds the v=DMARC1 TXT record that belongs at _dmarc.<domain>, and validates the parts people get wrong: reporting URIs that are not mailto:, pct outside 0–100, fo with no ruf, and external report destinations that need an authorisation record on the other domain. Computed entirely in this browser.
1. Observe. Publish v=DMARC1; p=none; rua=mailto:dmarc@yourdomain. Nothing changes for your mail; receivers start sending you a daily XML report of every source sending as your domain. Leave it for two to four weeks — one full billing, payroll and marketing cycle — so the shadow IT surfaces.
2. Fix alignment. Read the reports and, for every legitimate source, make SPF or DKIM align with the From: domain. DMARC needs only one of the two to pass and align, and DKIM is the one that survives forwarding, so prefer getting DKIM right. Do not move on while a legitimate sender is still failing.
3. Quarantine, gradually. Move to p=quarantine; pct=25, then 50, then 100, watching reports at each step. Failing mail goes to spam rather than being lost, so a mistake is recoverable.
4. Reject. Publish p=reject. Receivers now refuse spoofed mail at SMTP time. Add sp=reject if it is not already inherited, and publish v=spf1 -all plus v=DMARC1; p=reject on every parked domain you own.
External reporting. If rua or ruf points at a mailbox outside your organizational domain, RFC 7489 §7.1 requires that domain to publish <your-domain>._report._dmarc.<their-domain> as a TXT record containing v=DMARC1;. Without it, conforming reporters simply do not send. Hosted DMARC vendors publish it for you — but check.
DMARC only grades the alignment of SPF and DKIM; it performs no check of its own. Get SPF and DKIM working first.
Every tool in this section runs entirely inside your browser on the WebCrypto API
(crypto.subtle) and plain JavaScript. Passphrases, private keys, TOTP secrets, files and
passwords are never uploaded, never logged, and never touch h4ck0r.com's servers — the network tab
stays empty while you use them. The single exception is the Password Breach Check,
which sends exactly five hexadecimal characters (the first five of a SHA-1 computed here in the page)
and nothing else. That is the whole request. Everything else is matched locally against the reply.
Passphrase-based AES-256-GCM. The key is derived with PBKDF2-HMAC-SHA256 over a random 16-byte salt at 250,000 iterations; every operation uses a fresh random 12-byte IV. The output is a self-describing Base64 envelope holding the KDF parameters, salt, IV and ciphertext, so decryption needs nothing but the blob and the passphrase.
crypto.getRandomValues() on every single encryption. A new random salt is
drawn too, so encrypting the same text twice with the same passphrase yields two entirely
different envelopes.
Generates an RSA, ECDSA or Ed25519 key pair with crypto.subtle.generateKey() and exports it as PEM — SubjectPublicKeyInfo for the public half, PKCS#8 for the private half. Both halves are produced and stay in this tab; nothing is transmitted.
A full RFC 6238 / RFC 4226 implementation for debugging authenticator setups: it shows the previous, current and next codes at once, so you can tell instantly whether a failing login is a wrong secret or just clock drift. HMAC is computed with WebCrypto; the secret never leaves this page.
Paste a code from a phone or hardware token. It is checked against the current step and one step either side (the ±1 window almost every server allows), and the result tells you which step matched — that is how you diagnose clock drift.
Computes SHA-1, SHA-256, SHA-384 and SHA-512 over one or more local files and compares them against an expected digest — the standard way to verify that a download was not corrupted or tampered with. Files are read with FileReader and hashed in this tab; nothing is uploaded.
crypto.subtle.digest() has no streaming interface — it takes one complete
ArrayBuffer, so the whole file must be held in memory at once. Files are therefore
capped at 256 MB; anything larger is rejected with a message rather than crashing
the tab. For bigger files use sha256sum, shasum -a 256 or
Get-FileHash locally.
Explains a password rather than scoring it: which character sets it actually uses, the theoretical entropy that implies, every pattern that eats into that number, and what the result means at four honest, clearly-labelled attack rates. Runs entirely in this tab — the password is never sent anywhere, and this panel makes no network request at all.
Checks a password against the Pwned Passwords corpus of previously-breached credentials. The password never leaves this page and neither does its hash. SHA-1 is computed here in the browser; only the first five hexadecimal characters are sent, and the remaining thirty-five are matched locally against the reply. The value is never logged, never stored and never written to the URL.
SHA-1(password) and keeps all 40 hex characters. It sends only
the first 5. There are 165 = 1,048,576 possible prefixes spread across
roughly a billion breached hashes, so every prefix is shared by several hundred different
passwords. The server returns all the hash suffixes in that bucket and this page finds its
own suffix in the list offline. h4ck0r.com, the network, and the upstream corpus all learn only
that someone asked about one of a few hundred candidate hashes — which is no information
at all. The request is a POST, so the prefix never lands in a web-server access log or a
Referer header.
Caesar/ROT-N, ROT13, ROT47, Atbash, Vigenère, XOR, Rail Fence, Bacon, A1Z26 and Morse, in both directions, plus frequency analysis to help crack the ones you have not been given a key for. None of these protect anything. Every one is broken by hand or by a laptop in milliseconds — they are historical curiosities and CTF puzzle formats. For real confidentiality use the AES-GCM tool above.
Decoding is most of triage. These tools unwrap layered encodings, read raw bytes, and expose the Unicode tricks that make a hostile domain or filename look harmless. Everything below runs locally in your browser — no data is sent anywhere.
Chain transforms in order and watch the data come apart. Paste the blob,
stack the operations, and the whole chain re-runs as you type — the standard way to peel a
layered payload like base64 → URL-decode → defang.
Recipes are plain JSON and stay on your machine — copy the text below to keep one, or paste a saved one in and press Load. Nothing is stored on the server.
The three alphabets Base64 does not cover: RFC 4648 Base32 (TOTP secrets,
onion addresses), Base58 (Bitcoin addresses and keys — no 0, O,
I or l), and Ascii85 (PDF streams, PostScript).
1
characters, which is what makes an address starting 1 decode correctly.
Ascii85 is the Adobe/btoa variant: z is shorthand for four zero bytes,
<~ ~> delimiters are stripped on decode; the btoa-only y
(four spaces) shorthand is not implemented. Non-ASCII input is encoded as UTF-8
first, and the byte count is shown so you can see the difference.
Paste a domain or URL to see its real characters. Converts between Unicode
and xn-- Punycode (RFC 3492), flags mixed scripts and Latin look-alikes, and
catches invisible or direction-flipping characters — the machinery behind a domain that
renders as example.com but is really xn--exmple-4nf.com.
A classic hex dump plus strings and magic-byte identification.
Use it to find out what a file really is when the extension lies, and to pull URLs, paths and
commands out of a binary.
offset 8 bytes 8 bytes |ASCII|, with
non-printable bytes shown as . — identical to xxd. Files are
read up to 8 MB and the rendered dump is capped at 64 KB so a large file cannot lock the
tab; strings extraction and signature detection still run over the whole file. A file
with no matching signature is normal — only container and executable formats carry magic
bytes.
Rewrites indicators so nobody clicks them by accident:
http://evil.example becomes hxxp[://]evil[.]example. Defanging is
standard practice when malicious URLs, domains and IPs travel through chat, tickets and
email — and refanging turns a report back into something you can feed a tool.
:// → [://], http →
hxxp, ftp → fxp, . →
[.] and @ → [@]. Refanging reverses all of those
and additionally accepts the (.), {.}, [dot],
(at) and [:]// variants you find in vendor reports. By default
only tokens that actually look like a URL, domain, IPv4 address or email are touched,
so surrounding prose survives unchanged. Output is always rendered as inert plain text.
Breaks text into code points and shows the bytes behind each one — UTF-8, UTF-16, general category and block. Use it when a username, filename or password behaves strangely, or when two strings look identical but do not compare equal.
.length
counts UTF-16 units, so one emoji costs two; a database column sized in bytes fills up
four times faster with CJK text than with ASCII. Those mismatches are where truncation
bugs and validation bypasses come from. General category is read from the browser's own
Unicode tables via property escapes rather than guessed, and blocks are reported only
when the code point falls inside a known range.
Paste an email, an incident report or a log extract and pull every indicator out of it: IPv4/IPv6 addresses, domains, URLs, email addresses, MD5/SHA-1/SHA-256/SHA-512 hashes, CVE ids, MITRE ATT&CK technique ids, Bitcoin and Ethereum addresses, Windows and Unix file paths, registry keys and AS numbers — de-duplicated and grouped. Defanged input (hxxp, [.], (.), [@]) is refanged automatically. Everything runs in your browser; nothing is uploaded.
setup.exe, report.pdf and v1.2.3 out of the results. .zip and .mov are deliberately treated as file extensions rather than gTLDs. Private, loopback, CGNAT, link-local and documentation addresses are separated into their own “internal / reserved” groups instead of being dropped, because in a triage blob they are usually the victim, not the attacker. Wallet addresses are matched on format only — no checksum is verified.Score a vulnerability with the official CVSS v3.1 base and temporal equations, or build a valid CVSS v4.0 vector string. Paste an existing vector to load it back into the selectors.
CVSS:4.0/… string; take it to FIRST's official v4.0 calculator for the score. Shipping a guessed number here would be worse than shipping none.Give it an IP address, a hostname or an AS number and it reports the covering BGP prefix, the origin ASN and its holder, the RPKI validation state of that announcement, the registry and country, prefix counts, global visibility across RIS collector peers, and — for an AS query — the prefixes it announces. Passive: it reads public routing data, it never touches the target.
Generates the lookalike domains an attacker would register against your brand — character omission, duplication, transposition, adjacent-key slips, vowel swaps, homoglyphs, hyphenation, TLD swaps, subdomain-as-domain and prefix/suffix additions — each labelled with the technique. Then optionally checks which of them actually resolve, so you can see which lookalikes are already registered and pointed somewhere. This is brand-protection tooling: use it on domains you own.
Builds advanced search-engine, Shodan and Censys queries for reviewing what is already publicly indexed about a domain you own — exposed documents, open directory listings, login portals, config and backup files, leaked error messages, internet-facing devices and certificate records. Fill the form, or pick a ready-made recipe.
Every recipe is scoped to the domain in the field above. Enter it first, then pick one.
Network-engineering and offensive-security scratch tools that run entirely in the browser, plus one live latency probe. Everything here complements the calculators already in the toolkit above.
Expand and RFC 5952-compress any IPv6 prefix, then read off the network and last address, address type, reverse-DNS (ip6.arpa) name, and how many /64s it holds. Optionally carve it into equal subnets.
2001:db8::/32, fe80::/10 or ::1/128.Three IPv4 address-math tools in one: aggregate a messy list of hosts/blocks into the minimal covering set, split a block into equal subnets, or test containment and subtract one block from another.
Assemble an nmap command from a form and get a plain-English breakdown of exactly what every flag does. It builds a string to copy — it does not run anything.
Paste or drop Apache/Nginx access-log lines (Common or Combined format, vhost prefix tolerated). Get traffic stats plus security signals: scanner user-agents, 401/403/404 bursts, sensitive-path probing and injection attempts. Everything is parsed locally in your browser.
Times repeated TCP connects to one public host and reports min/avg/max, standard deviation and jitter. This measures TCP connect time (the full three-way handshake), not an ICMP ping — the numbers read slightly higher and cannot be compared to ping one-for-one.
Turn a few base words into a candidate wordlist for authorised password audits and CTFs: case variants, leet substitutions, appended/prepended numbers and years, symbols, word-pair concatenation and reversal. The estimated size updates as you toggle rules; generation is hard-capped.
Running a scan is easy; reading one is the skill. These 16 modules — 34,469 words — cover the protocols, records and attacks the tools above are actually measuring: how a name gets resolved and how that resolution is abused, what a TLS certificate chain proves and what it does not, which HTTP response header stops which attack, how SPF, DKIM and DMARC decide a message is forged, how passwords are stored and how they are cracked, and where the line sits between authorised testing and unauthorised access. Free, no signup, no API key.
h4ck0r.com/learn/net-dns/ that you can
bookmark, share or print. Modules build in order within a track, but each is written to
stand alone. Opening one does not close the others. Modules you have read are tagged
✓ read on their card; that flag
lives in this browser's local storage and is never sent anywhere.
Reading about a technique is not the same as doing it. The labs are the hands-on half of h4ck0r.com: short, self-contained exercises you can finish in a browser tab, with no signup and nothing to install.
Everything below runs entirely in your browser — no target is contacted, no score is uploaded, and progress is kept in local storage on this device only.
Eight capture-the-flag puzzles across encoding, classical ciphers, hashing, binary and subnetting. Each one is solvable with the toolkit above — decode the cipher, work out the answer, submit FLAG{…}.
A timed typing test with a shell-flavoured word pool: plain English, source code, or command-line syntax. Accuracy on symbols and flags is the skill that actually saves time in a terminal.
Bit Catcher — catch the 1s, dodge the 0s. A palate cleanser between lookups, sitting alongside the live security feed further up the page.
Not every flag is printed next to its challenge. At least one is hidden in this page's markup, so if a puzzle gives you nothing to decode, read the source — that is the exercise. Clear all eight and the site will let you know.
Vulnerabilities published to the NIST National Vulnerability Database in the last seven days, newest first, with the CVSS base severity and score attached to each record. Served through this site's own /api/cve.php endpoint and cached for 30 minutes, so refreshing costs NVD nothing.
Severity comes from the highest CVSS metric NVD has published for the entry (v3.1, then v3.0, then v2). Freshly assigned CVEs are often still awaiting analysis and will show no score — that is a gap in the record, not a low-risk finding. Click any entry to open its full NVD page.
h4ck0r.com is a free, browser-based network security and reconnaissance suite — and a learning resource for the protocols underneath it. No accounts, no signup, no paywall, no upsell.
The recon tools are real. RDAP/WHOIS, DNS, TLS and certificate inspection, HTTP security headers, certificate-transparency search, ASN and routing lookups and TCP reachability checks all run server-side against live targets through this site's own /api backend. Nothing is mocked, replayed from a fixture, or faked for the demo.
The terminal is a simulator. It is a sandbox for practising shell syntax and command flow — it never connects to a real machine, and neither do the CTF challenges or the labs. Everything else on this page that says it hits the network, hits the network.
A small PHP API on a single host. Answers come from keyless public data sources — RDAP for registration data, DNS-over-HTTPS for resolution, crt.sh for certificate transparency logs, RIPEstat for routing and ASN data, the NIST NVD for vulnerability records — plus direct TLS and HTTP connections made from the server to the target you name.
Every endpoint validates its input, resolves the target and refuses private, loopback, link-local and reserved addresses before it opens a socket (SSRF guard), sets short connect and read timeouts, and enforces a per-IP sliding-window rate limit. Slow upstreams are cached on disk and served stale rather than failing outright, so a registry having a bad day degrades the answer instead of breaking the tool.
There is no database and no session store. The only server-side state is a transient rate-limit counter — a short list of request timestamps keyed to an IP, which ages out on its own.
No analytics, no third-party scripts, no tracking cookies, no fingerprinting, no ad network. Lookups are not written to a database, not attached to a visitor, and not retained once the response has been returned.
Client-side tools — encoders, hash and cipher utilities, the JWT decoder, subnet math, the terminal simulator, the typing test and the games — run entirely in the browser and send nothing anywhere. The password-breach check uses k-anonymity: only the first five hex characters of the SHA-1 digest ever leave the browser, never the password and never the full hash.
These are diagnostic tools — the same class of thing as securityheaders.com, MXToolbox or crt.sh — built for defenders, operators, administrators and students. There is no exploitation capability here, no payload delivery, no credential stuffing, no flooding, and no range scanning: one named target at a time.
Passive lookups against public records — RDAP, DNS, certificate transparency, routing data — are fair game against any domain. Active probes are not. Only run the port scanner, exposure check, HTTP method probe, or any other tool that sends traffic at a host, against systems you own or have explicit written authorisation to test.
Unauthorised access to, or probing of, computer systems is a criminal offence in most jurisdictions — the Computer Fraud and Abuse Act in the United States, the Computer Misuse Act in the United Kingdom, and broadly comparable legislation nearly everywhere else. "It was only a scan" is not a defence, and permission from a hosting provider is not permission from the system's owner. Get authorisation in writing, in advance, and stay inside the scope it grants you.
Active endpoints are rate-limited per IP. Traffic that trips those limits is blocked at the edge and recorded by the web server and firewall in the ordinary way. Do not use this site as a staging post for attacks on third parties.
Everything here is provided as-is, for education and diagnostics, with no warranty of any kind. Results can be stale, incomplete or simply wrong — registries, resolvers and transparency logs disagree with each other routinely. Verify anything you intend to act on. h4ck0r.com accepts no liability for how these tools are used.
Report abuse, bad data or a broken tool to [email protected] or [email protected]. Longer write-ups on what has been built and how it works live in the notebook, and dated release notes are in the build log.
.bak or ~ suffix. A batch of edge-case crashes across the tools was fixed — malformed input, empty upstream responses and unusual character sets no longer take a panel down. The accessibility pass gave icon-only controls proper labels, made the terminal and tool panels readable to screen readers, and fixed keyboard navigation through the tool grid. Fewer new toys, more things that just work.
~all or +all terminator that never enforces anything, missing or short DKIM selectors, and DMARC left at p=none so failures are reported but never rejected. Output is the record, the verdict and the specific fix.
🎉 ACCESS GRANTED 🎉
You found the secret! You're a true h4ck0r.
↑↑↓↓←→←→BA