Free security tools

Security tools that run in your browser.

135 tools for SOC analysts, pentesters, GRC teams and developers — headers, phishing, CVSS, Sigma, DORA, DNS, hashing and more.

Browse all tools → Try a workflow

Today’s set

Exploited CVE of the day

CVE-2015-3306

ProFTPD · ProFTPD

EPSS 0.995 · top 0.1% · CVSS 10.0

Featured tool Subdomain Takeover Checker

FreeFull ticket →Past sets

Most used this month

PGP Key Lookup & InspectorFind PGP keys by email/fingerprint, or decode a pasted key. Security Feeds (RSS)Aggregated security news, CVEs, threat intel from 40+ sources. DNS MapperMap DNS infra with visual graphs and subdomain discovery. Phishing CheckerSniff out suspicious URLs. Typosquatting detection included. MITRE ATT&CK SearchSearch the ATT&CK matrix by tactic, technique or ID. IOC DefangerDefang malicious indicators for safe sharing. Email Security CheckerSPF, DKIM, DMARC at a glance. Holy trinity of email security. HTTP Security Headers GraderGrade headers A+ to F, with a fix for each missing one.

Recently updated

Text ToolkitNew Text Toolkit: case conversion, cleaning and statistics in one tool.Updated Cron ParserCorrect next-run times and timezones.Updated ICS Calendar GeneratorStandards-correct files for non-English text and all-day repeats.Updated UUID GeneratorV5 and v7 now work, and the version notes are accurate.Updated

Web & Domain Security

TLS, headers, cookies and domain hardening.

View all 17 →
HTTP Security Headers Grader Runs in your browser; some lookups go through our server (your IP is never forwarded):

Grade a site's HTTP security headers from A+ to F.
SSL Certificate Checker Runs on our server (nothing stored or logged):

Check a TLS certificate's chain, expiry, protocols and cipher strength.
CSP Builder Runs entirely in your browser:

Compose a Content-Security-Policy header with directive guidance and validation.
Domain Security Posture Scanner Runs on our server (nothing stored or logged):

Scan a domain's DNS, email, TLS and headers for a posture grade.

Detection & SOC

SIEM, detection engineering and SOC operations.

View all 10 →
MITRE ATT&CK Search Runs entirely in your browser:

Search MITRE ATT&CK tactics, techniques and procedures offline in your browser.
Sigma Rule Builder Runs entirely in your browser:

Build Sigma detection rules visually and convert to Splunk, Sentinel, QRadar.
YARA Rule Builder & Tester Runs entirely in your browser:

Build and test YARA rules against sample files in your browser.
SIEM Query Template Library NEW Runs entirely in your browser:

Browse ready-made SIEM queries for Splunk, Sentinel, QRadar and Elastic.

GRC & Compliance

Governance, risk and regulatory readiness.

View all 16 →
DORA Compliance Checker Runs entirely in your browser:

Assess DORA readiness across ICT risk, incident reporting and resilience testing.
Compliance Reference Database Runs entirely in your browser:

Search GDPR, NIS2, DORA, PCI DSS and ISO 27001 controls together.
NIS2 Self-Assessment Runs entirely in your browser:

Self-assess NIS2 obligations and get a gap list with priorities.
ISO 27001 SoA Builder Runs entirely in your browser:

Build an ISO 27001 Statement of Applicability across all Annex A controls.

Formatters & Converters

JSON, SQL, CSV, diff, Markdown, text and color.

View all 8 →
JSON / YAML / PHP Formatter Runs entirely in your browser:

Beautify, minify and validate JSON with syntax highlighting and error hints.
Regex Tester Runs entirely in your browser:

Test regular expressions live with capture groups, flags and match highlighting.
Diff Tool Runs entirely in your browser:

Compare two blocks of text and highlight every added or removed line.
Text Toolkit Runs entirely in your browser:

Convert case, clean and normalise text, and read word and readability stats.

Workflows

Chained tools around one shared case.

View all 3 →
IR Flow: Phishing Investigation NEW

URL and headers in; DMARC verdict, defanged indicators, STIX out.
IR Flow: Ransomware Response NEW

Guided ransomware playbook with embedded tools and after-action export.
Domain Security Review NEW

DNS, email auth, TLS and headers scored in one pass.

 Suggest a workflow →

Which tools do you chain by hand? Tell us.

More categories

Email & Phishing 6Investigate suspicious emails, headers, auth and QR codes Network & DNS 13DNS, IP, WHOIS, ports and network infrastructure Incident Response & Threat Intel 11IOCs, timelines, STIX and incident tooling Vulnerability Management 6CVSS, EPSS, SSVC, KEV and dependency scanning Crypto, Keys & Passwords 14Hashing, encryption, keys, tokens and passwords Cloud Security 4IAM, storage exposure, containers and secrets AI Security 11LLM cost, prompts, safety and AI governance Web, HTTP & Files 9URLs, requests, status codes, user-agents, file types and image metadata Everyday Utilities & Generators 11Time, cron, permissions, IDs, QR codes, test data and encoders

Browse all 135 tools →

For network administrators

CyberRamen.com is a defensive, blue-team resource — SOC, DFIR, detection-engineering and GRC references plus utilities that run entirely in your browser (nothing you paste or type leaves the page). It is safe to allow cyberramen.com for your security, SOC and GRC teams.

Offensive / red-team tooling lives on a deliberately separate domain, offensiveramen.com, which you can restrict to your pentest team — so you can set policy per site. Questions: hello@cyberramen.com.

Content filters may list this under “Hacking / Computer Security” — that categorises the topic, not the intent; everything here is for defenders.

Tools are provided for educational and authorized use only. You are responsible for compliance with applicable laws.