Yefosec

Free tools

Check a security question now.

31 no-signup tools cover domains, credentials, code, data, risk and control maturity. Local tools keep input on this device; source-labelled checks send only the required query to the named provider.

Only check systems and code you own or are explicitly authorised to test. Some external services actively inspect public endpoints. Results are best-effort and are not a substitute for an authorised security assessment.

Local by default

Generators, decoders, redaction and self-assessments run in your browser. Inputs and results are not sent to a Yefosec backend.

Named external checks

API badges identify when a domain, package, repository name or partial hash leaves the device. See the privacy details for provider-specific handling.

Domain & networkCredentialsCode & dataGovernance & risk

Domain & network

Full Domain Report

One scan: website security grade, email spoofing posture and registration details, merged into a single report.

MozillaDoHRDAP

Website Health Check

Security-header and policy grade via Mozilla HTTP Observatory.

Mozilla API

TLS Configuration Check

Certificate, protocol and endpoint grade via SSL Labs.

SSL Labs API

Domain Exposure

Discover subdomains from public certificate transparency logs (crt.sh).

crt.sh API

Email Security

Check MX, SPF and DMARC records that stop attackers spoofing your domain.

Google DoH

Domain WHOIS (RDAP)

Registrar, registration/expiry dates, status and nameservers via RDAP — the structured successor to WHOIS.

RDAP API

Security Header Generator

Generate hardened HTTP security headers as nginx, Apache, Caddy or raw config.

Local onlyCopy config
add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
add_header Content-Security-Policy "default-src 'self'; object-src 'none'; frame-ancestors 'self'; base-uri 'self'" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "DENY" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Permissions-Policy "geolocation=(), camera=(), microphone=()" always;

SPF / DMARC Generator

Build valid SPF and DMARC TXT records to stop attackers spoofing your domain.

Local onlyDNS records

SPF record

v=spf1 include:_spf.google.com -all

DMARC record

v=DMARC1; p=quarantine;

Publish DMARC at _dmarc.yourdomain. Start at p=none, then tighten to quarantine and reject.

security.txt Generator

Create and validate an RFC 9116 security.txt file for vulnerability disclosure contacts.

Local onlyRFC 9116
# Security contact information for vulnerability disclosure
# See RFC 9116: https://www.rfc-editor.org/rfc/rfc9116
Contact: mailto:security@example.com
Expires: 2027-07-17T00:00:00Z
Preferred-Languages: en
Canonical: https://example.com/.well-known/security.txt

Subnet / CIDR Calculator

Network, broadcast, mask, host range and counts for an IPv4 CIDR block.

Local only
Network
192.168.1.0
Broadcast
192.168.1.255
Netmask
255.255.255.0
Wildcard
0.0.0.255
Host range
192.168.1.1 – 192.168.1.254
Usable hosts
254
Total addresses
256

Credentials

Password Breach Check

See if a password appears in known breaches. Uses k-anonymity — only the first 5 characters of its SHA-1 hash are sent; the password never leaves your browser.

HIBP APIk-anonymity

Password Strength

Rough entropy estimate with pattern penalties. A guide, not a guarantee — the value is never sent anywhere.

Local only

Password Generator

Cryptographically-strong passwords and passphrases, generated in your browser.

Local only
fxf4NVBVm*n8d5j8qc39

Code & data

Secret Scan

Scan a code archive for leaked credentials — runs entirely in your browser; the file never leaves your machine.

Local onlyFile stays here

SBOM / Lockfile Vulnerability Check

Check package-lock.json or CycloneDX JSON components against OSV for known vulnerable package versions.

OSV APIFile parsed locally

OpenSSF Scorecard Lookup

Review public software supply-chain hygiene for a GitHub repository.

OpenSSF APIPublic repos

Hash Generator

SHA-1 / SHA-256 / SHA-512 of text or a file (e.g. to match an IOC). Computed in your browser via Web Crypto.

Local only

IOC Extractor

Pull IPs, domains, URLs, emails and file hashes out of pasted text. Defang/refang for safe sharing. Runs entirely in your browser.

Local only

JWT Decoder

Decode a JWT's header and payload. The signature is NOT verified — never trust an unverified token.

Local only

Encoder / Decoder

Base64, hex and URL encode/decode. UTF-8 safe, runs in your browser.

Local only
PII / Log Redactor
Strip emails, card numbers, NZ bank/IRD numbers, phone numbers, API keys and tokens from logs or tickets before sharing. Runs entirely in your browser.
Local only
Email Header Analyzer
Paste raw email headers to inspect the delivery path and SPF/DKIM/DMARC results. Phishing triage, in your browser.
Local only
Timestamp Converter
Convert a Unix epoch (seconds or ms) or a date to ISO, UTC, and NZ/AU local time.
Local only
Epoch (s)
1784327919
Epoch (ms)
1784327919000
ISO 8601
2026-07-17T22:38:39.000Z
UTC
Fri, 17 Jul 2026 22:38:39 GMT
New Zealand
18 Jul 2026, 10:38:39 am NZST
Australia (Syd)
18 Jul 2026, 8:38:39 am AEST
Governance & risk
Essential Eight Self-Assessment
Rate your maturity (ML0–ML3) against the ACSC Essential Eight. Indicative only — not an official assessment.
Local onlyExport pack
Application control
Patch applications
Microsoft Office macro settings
User application hardening
Restrict administrative privileges
Patch operating systems
Multi-factor authentication
Regular backups
Overall maturity (weakest strategy)
ML0*
*unrated strategies count as ML0
Want help closing these gaps? Yefosec helps NZ & AU teams act on results like these.Email us 
NZISM Self-Assessment
Rate coverage against selected NZISM control areas. Indicative only, not an official NZISM assessment or certification.
Local onlyExport pack
Information security governance & policy
Information security risk management
Personnel security (clearances, training, offboarding)
Physical security of systems & media
Identification, authentication & access control
Privileged access management
Approved cryptography & key management
Network security & segmentation
Gateways & cross-domain data transfer
Software security, patching & hardening
Email & web content security
Mobile devices & working away from the office
Cloud & outsourced service assurance
Logging, monitoring & audit
Incident management & response
Business continuity & backups
Estimated coverage
0% *
*unrated items count as 0
Want help closing these gaps? Yefosec helps NZ & AU teams act on results like these.Email us 
CIS Controls v8 Self-Assessment
Rate the 18 CIS Critical Security Controls as an implementation baseline. Any mapping to NZISM or the Essential Eight depends on scope. Indicative only.
Local onlyExport pack
1. Inventory & control of enterprise assets
2. Inventory & control of software assets
3. Data protection
4. Secure configuration of assets & software
5. Account management
6. Access control management
7. Continuous vulnerability management
8. Audit log management
9. Email & web browser protections
10. Malware defenses
11. Data recovery
12. Network infrastructure management
13. Network monitoring & defense
14. Security awareness & skills training
15. Service provider management
16. Application software security
17. Incident response management
18. Penetration testing
Estimated coverage
0% *
*unrated items count as 0
Want help closing these gaps? Yefosec helps NZ & AU teams act on results like these.Email us 
Cyber Risk Quantifier
Turn a qualitative likelihood × impact score into an annualised loss exposure (FAIR-style Monte Carlo).
Local only
LikelihoodPossible
ImpactMajor
Illustrative annualised loss exposure (median)
AUD 213k
AUD 79k (p5)AUD 576k (p95)
90% confidence interval from 10,000 Monte-Carlo samples. AUD loss bands are illustrative; calibrate the model to your organisation, loss data and reporting currency before using it in decisions.
CVSS Calculator
Build a CVSS base score from the metric values. Pure client-side; v4.0 uses FIRST's official reference implementation.
Local only
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
9.8Critical
MITRE ATT&CK Coverage Mapper
Extract ATT&CK technique IDs from detection notes, Sigma rules, reports or test plans and summarise coverage by tactic.
Local onlyCurated map
Incident Tabletop Pack Generator
Generate a practical tabletop agenda, injects, decision points and evidence checklist for common cyber scenarios.
Local onlyExport pack
# Ransomware Tabletop Exercise

Sector/context: Financial services
Team: Lean SOC with IT escalation
Duration: 90 minutes

## Scenario
Multiple users report file share errors. EDR shows suspicious encryption activity on a server.

## Objectives
- Confirm incident command roles, escalation paths and decision owners.
- Test evidence capture, legal/privacy triggers and executive updates.
- Identify gaps in detections, playbooks, supplier comms and recovery.

## Agenda
- 0-10 min: brief scope, roles and ground rules.
- 10-45 min: work through injects and record decisions.
- 45-70 min: validate evidence, communications and recovery actions.
- 70-90 min: capture gaps, owners and 30-day improvements.

## Injects
- 1. Helpdesk receives five tickets about unreadable shared files.
- 2. A ransom note appears in one team folder.
- 3. Backups are available, but the last restore test failed.
- 4. A journalist emails asking whether customer data was affected.

## Decision Points
- Isolate systems now or preserve access for investigation?
- When do you notify executives?
- Who approves restoration from backup?

## Evidence To Capture
- Timeline of detection, escalation and containment decisions.
- Logs, alerts, screenshots and affected asset/account list.
- Approval records for isolation, communication and recovery.
- Privacy/regulatory assessment and notification rationale.

## Outputs
- Immediate containment checklist.
- 30-day remediation owner list.
- Detection and playbook improvements.
- Executive summary for governance reporting.
Security Posture Score
Aggregate Red Team, SOC and CISO metrics into a single 0–100 posture grade. Indicative model — calibrate the inputs to your org.
Local onlyExport pack
Red Team
SOC
CISO
53/ 100D
Red Team 72SOC 53CISO 34
Want help closing these gaps? Yefosec helps NZ & AU teams act on results like these.Email us 
Turn a finding into an owned plan.
Yefosec helps New Zealand and Australian teams prioritise the gap, assign the next decision and improve the surrounding workflow or evidence.
 Email an enquiry