Free Cybersecurity Tools

A small suite of fast, privacy-respecting utilities for security researchers, penetration testers, and sysadmins. Every tool below runs entirely in your browser — no sign-up, no tracking, and nothing you paste ever leaves your device. Bookmark this page and reach for it whenever you need to score a CVE, plan a subnet, encode a payload, or inspect a certificate.

CVSS 3.1 Calculator

Select each metric or paste a CVSS vector to compute the Base Score. All calculations run in your browser — no data ever leaves your device.

PASTE VECTOR (optional)

0.0

NONE

Base Score · CVSS v3.1

Impact 0.0 Exploitability 0.0

Want to be alerted before a CVSS 9.0+ hits your stack? CVE Watchtower sends real-time alerts, filtered by the technologies you run.

See CVE Alert plans →

IP / Subnet Calculator

Enter an IPv4 address with CIDR notation. The tool computes the network, broadcast, host range, wildcard mask, and usable host count — instantly, right in your browser.

IP ADDRESS + CIDR

OR PICK A PREFIX

This tool is free, with no limits. If you find it useful, follow our weekly security newsletter — the CVEs that matter, no spam.

Subscribe to the newsletter →

Encoder & Hash Generator

Base64, URL encoding, and hash functions (SHA-1, SHA-256, SHA-384, SHA-512) — powered by your browser's Web Crypto API. Nothing is sent to a server.

INPUT

BASE64

—

URL ENCODING

—

HASH (updates live as you type) Web Crypto · SubtleCrypto

Devs and pentesters use this toolkit every day. Read the latest CVE and PoC technical analysis on Daily CyberSecurity.

Read the latest advisories →

Certificate Viewer

Paste an X.509 certificate in PEM format to inspect its subject, issuer, validity period, and status. The certificate is parsed right in your browser — nothing is sent anywhere.

PEM CERTIFICATE

Coming soon (Pro): monitor certificate expiry across your domains and get alerted 30 days ahead. Never let a cert expire unexpectedly again.

Learn about Pro →

// The web version parses certificates you paste in (client-side). Automatically fetching a cert from a live domain will live in the Pro tier, running through a controlled API.