Free tools
Check a security question now.
32 no-signup tools cover domains, credentials, code, data, risk and control maturity. Local tools keep input on this device; source-labelled checks send only the required query to the named provider.
Only check systems and code you own or are explicitly authorised to test. Some external services actively inspect public endpoints. Results are best-effort and are not a substitute for an authorised security assessment.
Local by default
Generators, decoders, redaction and self-assessments run in your browser. Inputs and results are not sent to a Yefosec backend.
Named external checks
API badges identify when a domain, package, repository name or partial hash leaves the device. See the privacy details for provider-specific handling.
Domain & network
Full Domain Report
One scan: website security grade, email spoofing posture and registration details, merged into a single report.
Website Health Check
Security-header and policy grade via Mozilla HTTP Observatory.
TLS Configuration Check
Certificate, protocol and endpoint grade via SSL Labs.
Domain Exposure
Discover subdomains from public certificate transparency logs (crt.sh).
Email Security
Check MX, SPF and DMARC records that stop attackers spoofing your domain.
Domain WHOIS (RDAP)
Registrar, registration/expiry dates, status and nameservers via RDAP — the structured successor to WHOIS.
Security Header Generator
Generate hardened HTTP security headers as nginx, Apache, Caddy or raw config.
add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always; add_header Content-Security-Policy "default-src 'self'; object-src 'none'; frame-ancestors 'self'; base-uri 'self'" always; add_header X-Content-Type-Options "nosniff" always; add_header X-Frame-Options "DENY" always; add_header Referrer-Policy "strict-origin-when-cross-origin" always; add_header Permissions-Policy "geolocation=(), camera=(), microphone=()" always;
SPF / DMARC Generator
Build valid SPF and DMARC TXT records to stop attackers spoofing your domain.
SPF record
v=spf1 include:_spf.google.com -allDMARC record
v=DMARC1; p=quarantine;Publish DMARC at _dmarc.yourdomain. Start at p=none, then tighten to quarantine and reject.
security.txt Generator
Create and validate an RFC 9116 security.txt file for vulnerability disclosure contacts.
# Security contact information for vulnerability disclosure # See RFC 9116: https://www.rfc-editor.org/rfc/rfc9116 Contact: mailto:security@example.com Expires: 2027-08-23T00:00:00Z Preferred-Languages: en Canonical: https://example.com/.well-known/security.txt
Subnet / CIDR Calculator
Network, broadcast, mask, host range and counts for an IPv4 CIDR block.
- Network
- 192.168.1.0
- Broadcast
- 192.168.1.255
- Netmask
- 255.255.255.0
- Wildcard
- 0.0.0.255
- Host range
- 192.168.1.1 – 192.168.1.254
- Usable hosts
- 254
- Total addresses
- 256
Credentials
Password Breach Check
See if a password appears in known breaches. Uses k-anonymity — only the first 5 characters of its SHA-1 hash are sent; the password never leaves your browser.
Password Strength
Rough entropy estimate with pattern penalties. A guide, not a guarantee — the value is never sent anywhere.
Password Generator
Cryptographically-strong passwords and passphrases, generated in your browser.
E?t#4hGi@nY3ekEyEXwG
Code & data
Secret Scan
Scan a code archive for leaked credentials — runs entirely in your browser; the file never leaves your machine.
SBOM / Lockfile Vulnerability Check
Check package-lock.json or CycloneDX JSON components against OSV for known vulnerable package versions.
OpenSSF Scorecard Lookup
Review public software supply-chain hygiene for a GitHub repository.
Hash Generator
SHA-1 / SHA-256 / SHA-512 of text or a file (e.g. to match an IOC). Computed in your browser via Web Crypto.
IOC Extractor
Pull IPs, domains, URLs, emails and file hashes out of pasted text. Defang/refang for safe sharing. Runs entirely in your browser.
JWT Decoder
Decode a JWT's header and payload. The signature is NOT verified — never trust an unverified token.
Encoder / Decoder
Base64, hex and URL encode/decode. UTF-8 safe, runs in your browser.
PII / Log Redactor
Strip emails, card numbers, NZ bank/IRD numbers, phone numbers, API keys and tokens from logs or tickets before sharing. Runs entirely in your browser.
Email Header Analyzer
Paste raw email headers to inspect the delivery path and SPF/DKIM/DMARC results. Phishing triage, in your browser.
Timestamp Converter
Convert a Unix epoch (seconds or ms) or a date to ISO, UTC, and NZ/AU local time.
- Epoch (s)
- 1787477555
- Epoch (ms)
- 1787477555000
- ISO 8601
- 2026-08-23T09:32:35.000Z
- UTC
- Sun, 23 Aug 2026 09:32:35 GMT
- New Zealand
- 23 Aug 2026, 9:32:35 pm NZST
- Australia (Syd)
- 23 Aug 2026, 7:32:35 pm AEST
Governance & risk
Essential Eight Self-Assessment
Rate your maturity (ML0–ML3) against the ACSC Essential Eight. Indicative only — not an official assessment.
Application control
Patch applications
Microsoft Office macro settings
User application hardening
Restrict administrative privileges
Patch operating systems
Multi-factor authentication
Regular backups
Overall maturity (weakest strategy)
ML0*
*unrated strategies count as ML0
NZISM Self-Assessment
Rate coverage against selected NZISM control areas. Indicative only, not an official NZISM assessment or certification.
Information security governance & policy
Information security risk management
Personnel security (clearances, training, offboarding)
Physical security of systems & media
Identification, authentication & access control
Privileged access management
Approved cryptography & key management
Network security & segmentation
Gateways & cross-domain data transfer
Software security, patching & hardening
Email & web content security
Mobile devices & working away from the office
Cloud & outsourced service assurance
Logging, monitoring & audit
Incident management & response
Business continuity & backups
Estimated coverage
0% *
*unrated items count as 0
CIS Controls v8 Self-Assessment
Rate the 18 CIS Critical Security Controls as an implementation baseline. Any mapping to NZISM or the Essential Eight depends on scope. Indicative only.
1. Inventory & control of enterprise assets
2. Inventory & control of software assets
3. Data protection
4. Secure configuration of assets & software
5. Account management
6. Access control management
7. Continuous vulnerability management
8. Audit log management
9. Email & web browser protections
10. Malware defenses
11. Data recovery
12. Network infrastructure management
13. Network monitoring & defense
14. Security awareness & skills training
15. Service provider management
16. Application software security
17. Incident response management
18. Penetration testing
Estimated coverage
0% *
*unrated items count as 0
Cyber Risk Quantifier
Turn a qualitative likelihood × impact score into an annualised loss exposure (FAIR-style Monte Carlo).
Illustrative annualised loss exposure (median)
AUD 213k
90% confidence interval from 10,000 Monte-Carlo samples. AUD loss bands are illustrative; calibrate the model to your organisation, loss data and reporting currency before using it in decisions.
CVSS Calculator
Build a CVSS base score from the metric values. Pure client-side; v4.0 uses FIRST's official reference implementation.
MITRE ATT&CK Coverage Mapper
Extract ATT&CK technique IDs from detection notes, Sigma rules, reports or test plans and summarise coverage by tactic.
Incident Tabletop Pack Generator
Generate a practical tabletop agenda, injects, decision points and evidence checklist for common cyber scenarios.
# Ransomware Tabletop Exercise Sector/context: Financial services Team: Lean SOC with IT escalation Duration: 90 minutes ## Scenario Multiple users report file share errors. EDR shows suspicious encryption activity on a server. ## Objectives - Confirm incident command roles, escalation paths and decision owners. - Test evidence capture, legal/privacy triggers and executive updates. - Identify gaps in detections, playbooks, supplier comms and recovery. ## Agenda - 0-10 min: brief scope, roles and ground rules. - 10-45 min: work through injects and record decisions. - 45-70 min: validate evidence, communications and recovery actions. - 70-90 min: capture gaps, owners and 30-day improvements. ## Injects - 1. Helpdesk receives five tickets about unreadable shared files. - 2. A ransom note appears in one team folder. - 3. Backups are available, but the last restore test failed. - 4. A journalist emails asking whether customer data was affected. ## Decision Points - Isolate systems now or preserve access for investigation? - When do you notify executives? - Who approves restoration from backup? ## Evidence To Capture - Timeline of detection, escalation and containment decisions. - Logs, alerts, screenshots and affected asset/account list. - Approval records for isolation, communication and recovery. - Privacy/regulatory assessment and notification rationale. ## Outputs - Immediate containment checklist. - 30-day remediation owner list. - Detection and playbook improvements. - Executive summary for governance reporting.
Security Posture Score
Aggregate Red Team, SOC and CISO metrics into a single 0–100 posture grade. Indicative model — calibrate the inputs to your org.
Red Team
SOC
CISO
Agentic SOC Readiness Assessment
Apply a weakest-link gate across governance, least agency, context, tools, evaluation, resilience, budgets and portability.
Average 0% · weakest-link 0/4
Do not expand autonomy beyond foundational until the weakest control reaches the next level.
Technology radar
Choose the operating boundary before the product.
These lifecycle decisions describe what Yefosec would approve, pilot, observe or refuse. They are architecture guidance, not vendor endorsements.
32 governed public tools
Approved
Default pattern within its stated boundary
Curated defensive skills
- Decision
- Use versioned, reviewed procedures with explicit evidence and authority contracts.
- Evidence
- Schema and reference validation in CI
- Boundary
- Guidance does not grant tools or production access
- Review trigger
- Procedure, framework or platform change
Deterministic browser tools
- Decision
- Prefer local calculation and parsing where no external service is needed.
- Evidence
- Unit tests and governed result envelopes
- Boundary
- Input remains in browser memory or documented local storage
- Review trigger
- Dependency, browser API or calculation-standard change
Source-labelled read APIs
- Decision
- Allow only registered origins, minimum public query data and fail-closed response handling.
- Evidence
- Origin, timeout, size and schema controls tested in CI
- Boundary
- Named provider receives only the documented query
- Review trigger
- Provider terms, endpoint, schema or retention change
Pilot
Measure under supervision before wider use
Supervised alert triage agents
- Decision
- Measure against a comparable baseline before production use.
- Evidence
- Synthetic scenarios and deterministic release gates
- Boundary
- Read-only evidence; response remains approval-gated
- Review trigger
- Quality, override, latency or safety drift
Multi-agent orchestration
- Decision
- Pilot only where one orchestrator enforces scope, budgets, handoffs and stop controls.
- Evidence
- Versioned workflow packs and investigation ledger
- Boundary
- No agent may expand its own authority or delegate around policy
- Review trigger
- Workflow, tool, model or autonomy change
Independent model review
- Decision
- Use as a secondary review after deterministic checks, never as the sole success signal.
- Evidence
- Evidence references must resolve to immutable source artifacts
- Boundary
- Reviewer model receives minimized synthetic or authorised evidence
- Review trigger
- Evaluator model, prompt, correlation or calibration change
Reviewed case-derived memory
- Decision
- Admit only curated summaries with source references, expiry and human approval.
- Evidence
- Tenant-scoped knowledge review and retrieval tests
- Boundary
- Raw logs and retrieved instructions are not promoted to memory
- Review trigger
- Source expiry, contradiction, incident review or policy change
Watch
Research or assess; do not operationalise yet
Unreviewed MCP and agent tools
- Decision
- Inventory and assess before connection; do not infer safety from tool descriptions.
- Evidence
- Require source pin, license, permissions, egress and destructive-action review
- Boundary
- No customer credentials or production route before approval
- Review trigger
- Publisher, package, permission or tool-schema change
Autonomous production remediation
- Decision
- Keep outside normal operation until bounded pilots establish reversible, observable safety.
- Evidence
- Requires production-like recovery tests and accountable risk acceptance
- Boundary
- No destructive, irreversible or broad production action
- Review trigger
- Approved risk appetite, recovery proof and measured pilot evidence
Agentic exploit generation
- Decision
- Use only in isolated authorised research; it is not part of the customer-facing control plane.
- Evidence
- Research benchmark evidence does not establish defensive SOC value
- Boundary
- Disposable lab, restricted egress, synthetic targets and no customer telemetry
- Review trigger
- Written research scope, data license and isolation review
Deprecated
Explicitly prohibited or being removed
Agent self-approval
- Decision
- Do not use. Approval must come from an authenticated accountable authority.
- Evidence
- Exact action-digest approvals and separation of duties
- Boundary
- Agents cannot create, widen or approve their own authority
- Review trigger
- None; prohibited invariant
Turn a finding into an owned plan.
Yefosec helps New Zealand and Australian teams prioritise the gap, assign the next decision and improve the surrounding workflow or evidence.
Email an enquiry