WebChecks

Security

Read the headers a site sends, the software it runs, its disclosure file, a token’s contents, and which authenticator a passkey came from.

Security Headers Check Grade a site's security headers and get specific fixes.
Security.txt Checker Validate a domain's RFC 9116 vulnerability disclosure file.
JWT Decoder Decode a JWT and read its claims — with Entra ID roles and app IDs resolved to names. beta runs locally
AAGUID Lookup Identify a passkey authenticator from its AAGUID.