Free security tools

Security tools that run in your browser.

138 tools for SOC analysts, pentesters, GRC teams and developers — headers, phishing, CVSS, Sigma, DORA, DNS, hashing and more.

Browse all tools → Try a workflow

Today’s set

Exploited CVE of the day

CVE-2015-3306

ProFTPD · ProFTPD

EPSS 0.980 · top 0.1% · CVSS 10.0

Featured tool Swiss FADP (nLPD) Self-Assessment

FreeFull ticket →Past sets

Most used this month

PGP Key Lookup & InspectorFind PGP keys by email/fingerprint, or decode a pasted key. Security Feeds (RSS)Aggregated security news, CVEs, threat intel from 40+ sources. DNS MapperMap DNS infra with visual graphs and subdomain discovery. Phishing CheckerSniff out suspicious URLs. Typosquatting detection included. IOC DefangerDefang malicious indicators for safe sharing. MITRE ATT&CK SearchSearch the ATT&CK matrix by tactic, technique or ID. Email Security CheckerSPF, DKIM, DMARC at a glance. Holy trinity of email security. HTTP Security Headers GraderGrade headers A+ to F, with a fix for each missing one.

Recently updated

Actionable CVEs DashboardKeyboard use.Updated Log RedactorLog Redactor catches more secrets.Updated Cipher DecoderNew addresses for three renamed tools, and plain wording everywhere.Updated Cookie Security AnalyzerCookie Analyzer: what each cookie is for.Updated

Web & Domain Security

TLS, headers, cookies and domain hardening.

View all 17 →
HTTP Security Headers Grader Runs in your browser; some lookups go through our server (your IP is never forwarded):

Grade a site's HTTP security headers from A+ to F.
SSL Certificate Checker Runs on our server (nothing stored or logged):

Check a TLS certificate's chain, expiry, protocols and cipher strength.
CSP Builder Runs entirely in your browser:

Compose a Content-Security-Policy header with directive guidance and validation.
Domain Security Posture Scanner Runs on our server (nothing stored or logged):

Scan a domain's DNS, email, TLS and headers for a posture grade.

Detection & SOC

SIEM, detection engineering and SOC operations.

View all 10 →
MITRE ATT&CK Search Runs entirely in your browser:

Search MITRE ATT&CK tactics, techniques and procedures offline in your browser.
Sigma Rule Builder Runs entirely in your browser:

Build Sigma detection rules visually and convert to Splunk, Sentinel, QRadar.
YARA Rule Builder & Tester Runs entirely in your browser:

Build and test YARA rules against sample files in your browser.
SIEM Query Template Library NEW Runs entirely in your browser:

Browse ready-made SIEM queries for Splunk, Sentinel, QRadar and Elastic.

GRC & Compliance

Governance, risk and regulatory readiness.

View all 16 →
DORA Compliance Checker Runs entirely in your browser:

Assess DORA readiness across ICT risk, incident reporting and resilience testing.
Compliance Reference Database Runs entirely in your browser:

Search GDPR, NIS2, DORA, PCI DSS and ISO 27001 controls together.
NIS2 Self-Assessment Runs entirely in your browser:

Self-assess NIS2 obligations and get a gap list with priorities.
ISO 27001 SoA Builder Runs entirely in your browser:

Build an ISO 27001 Statement of Applicability across all Annex A controls.

Dev & Everyday Utilities

Formatters, converters, encoders and generators.

View all 30 →
JSON / YAML / PHP Formatter Runs entirely in your browser:

Beautify, minify and validate JSON with syntax highlighting and error hints.
Regex Tester Runs entirely in your browser:

Test regular expressions live with capture groups, flags and match highlighting.
Diff Tool Runs entirely in your browser:

Compare two blocks of text and highlight every added or removed line.
UUID Generator Runs entirely in your browser:

Generate and validate UUID versions 1, 4 and 7 in bulk.

Workflows

Chained tools around one shared case.

View all 3 →
IR Flow: Phishing Investigation NEW

URL and headers in; DMARC verdict, defanged indicators, STIX out.
IR Flow: Ransomware Response NEW

Guided ransomware playbook with embedded tools and after-action export.
Domain Security Review NEW

DNS, email auth, TLS and headers scored in one pass.

 Suggest a workflow →

Which tools do you chain by hand? Tell us.

More categories

Email & Phishing 6Investigate suspicious emails, headers, auth and QR codes Network & DNS 13DNS, IP, WHOIS, ports and network infrastructure Incident Response & Threat Intel 11IOCs, timelines, STIX and incident tooling Vulnerability Management 6CVSS, EPSS, SSVC, KEV and dependency scanning Crypto, Keys & Passwords 14Hashing, encryption, keys, tokens and passwords Cloud Security 4IAM, storage exposure, containers and secrets AI Security 12LLM cost, prompts, safety and AI governance

Browse all 138 tools →

For network administrators

CyberRamen.com is a defensive, blue-team resource — SOC, DFIR, detection-engineering and GRC references plus utilities that run entirely in your browser (nothing you paste or type leaves the page). It is safe to allow cyberramen.com for your security, SOC and GRC teams.

Offensive / red-team tooling lives on a deliberately separate domain, offensiveramen.com, which you can restrict to your pentest team — so you can set policy per site. Questions: hello@cyberramen.com.

Content filters may list this under “Hacking / Computer Security” — that categorises the topic, not the intent; everything here is for defenders.

Tools are provided for educational and authorized use only. You are responsible for compliance with applicable laws.