FREE SECURITY TOOLS

Scan files, URLs, IPs, and domains against 70+ antivirus engines simultaneously. The go-to first check for anything suspicious.

Free malware sandbox by CrowdStrike. Submit a file and watch it execute in an isolated environment with full behavioral analysis.

Interactive online sandbox — watch malware run in real time, click through installers, and see network traffic live. Free tier available.

Scan any website for malware, blacklisting status, and injected scripts. Useful first step when a client site is flagged by browsers.

Deep analysis of SSL/TLS configuration — cipher suites, certificate chain, protocol support, and an A–F grade. Standard for compliance audits.

Checks HTTP response headers for CSP, HSTS, X-Frame-Options, and more. Instant letter grade with remediation guidance.

Mozilla's web security scanner — evaluates TLS, HTTP headers, cookies, and redirects. Scores against real-world best practices.

DNS lookup, MX records, SPF/DKIM/DMARC checks, blacklist monitoring, and SMTP diagnostics. Every sysadmin's email troubleshooting starting point.

Check if an email address appears in known data breaches. Troy Hunt's authoritative breach database — also covers password exposure via the Pwned Passwords API.

Validate and visualize a domain's DMARC record. Shows policy, alignment mode, and reporting addresses — critical for preventing email spoofing.

Search engine for internet-connected devices. Look up what ports and services your public IPs expose before an attacker does. Free tier available.

Verify DNS propagation across 100+ global resolvers simultaneously. Essential after any DNS change — migration, failover, or new record deployment.

Registrar, registration dates, name servers, and registrant info for any domain. First step in any domain-related investigation or ownership dispute.

Check an IP address against multiple blacklists and threat intelligence feeds. Useful when investigating suspicious traffic sources or sender reputation issues.

Open-source AWS security assessment CLI. Runs 300+ checks against CIS, NIST, SOC2, and PCI-DSS frameworks. Free, runs inside your own AWS account.

Test IAM policies before applying them. Simulate API calls against specific resources to verify allow/deny behavior — built into AWS at no cost.

Free AWS security posture assessment — checks IAM, S3 permissions, encryption, network exposure, and compliance against CIS benchmarks.