Security
What runs where, what is kept, and how to check what you download.
Browser tools
Each tool works in one of three ways. The difference is what leaves your browser.
- Tools marked "runs locally"
- The page and its code come from webchecks.io, and the work happens in your browser. Passwords, keys, certificates, tokens, files and pasted text you give these tools are not sent to the server.
- Reference and calculator tools
- Tools such as Subnet Calculator, Port Number Lookup and AAGUID Lookup load their data from webchecks.io with the page and search or calculate in your browser. What you type is not sent anywhere.
- Network checks
- Tools that check a domain, host, IP address or mail server send what you enter to the webchecks.io server, which runs the DNS queries, TLS handshakes, connections and registry lookups and returns the result. Some query third parties on your behalf, such as RDAP registries, DNS blacklists or Microsoft's public endpoints. Some results are cached for a short time. Requests are rate limited per IP address with counters that reset within a minute.
A few tools differ from these three:
- What is my IP?, IP Owner Lookup and Speed Test ask api.ipify.org for your public address directly from your browser, and Speed Test measures against Cloudflare's speed test service.
- JWT Decoder's optional signature check fetches the issuer's published keys from your browser. The token itself is not sent.
- One-Time Secret Sharing encrypts the secret in your browser. The server stores only the encrypted data and its expiry, never the key.
- Email Deliverability Test receives the message you send to its test address and keeps the parsed report for a limited time so the page can show it.
- An "Explain this" or "Describe these findings" button sends that check's findings to a language model hosted by Cloudflare. Nothing is sent until you press it.
Sign-in
An account is optional. It is needed only for monitoring and for favorites that follow you between browsers. Sign-in works by a link sent to your email address; there is no password. The account stores your email address, your sign-in sessions, your favorites, your monitors with their check history and alert settings, any DMARC reports you route to it, and your time zone and session-length preferences.
Desktop software
Software downloads are served from webchecks.io itself, from private storage that is reachable only through the site. The files are not code-signed. Each one is published with its SHA-256 hash, on its product page and in a SHA256SUMS.txt file next to it. A matching hash proves the file is the one published here, not who published it.
To check a download, run this in PowerShell in the download folder and compare the result with the published hash, ignoring case:
Get-FileHash .\file.exe -Algorithm SHA256
If the hash differs, delete the file. If it matches, Unblock-File .\file.exe removes the
downloaded-file mark, and on first start Windows SmartScreen may ask you to choose More info, then Run anyway.
The site keeps only an aggregate download count for each product, version and file. No IP address, browser details or other identifier is recorded with the count.
Reporting a vulnerability
Report a vulnerability in webchecks.io or its software through the contact form. Describe the issue and how to reproduce it, and include an email address if you would like a reply. Please test only against your own accounts and data. The same contact is listed in security.txt.