Anti-phishing & developer tools

Find the real destination behind Safe Links, URL Defense, Mimecast and other wrappers.

Spot lookalike domains: punycode and Unicode, mixed scripts and UTS #39 confusables.

Generate dnstwist-style typosquats of a domain and check which ones resolve in DNS.

Read a QR code from an image and see its link defanged before anyone opens it.

Find zero-width characters, bidi overrides and other invisible tricks in text and links.

Check up to 500 domains or URLs against the DestroyList phishing blocklist.

One domain, URL or IP → lookups on urlscan.io, VirusTotal, Safe Browsing and crt.sh.

Resolve A, AAAA, MX, TXT, NS, CNAME, CAA and SOA records through DNS over HTTPS.

Decode %XX sequences in links and redirect parameters, or percent-encode text.

Split a link into protocol, host, port, path, query and fragment, as the browser does.

Convert a dotted IPv4 address to its decimal integer, hexadecimal and binary forms.

Searchable table of common DNS record types, from A and MX to CAA and TLSA, explained.

What each WHOIS field means: registrar, dates, EPP status, name servers, abuse contacts.

Parse a .eml file: headers, Received chain, links, attachment hashes, sender mismatches.

Check a domain's SPF (with the 10-lookup limit), DMARC, DKIM, MTA-STS and BIMI records.

Paste an SMS or chat message to pull out links and phone numbers and flag smishing signs.

Unfold raw email headers into From, To, Subject, the Received hops and a header table.

Scan an HTML or SVG attachment for hidden payloads, atob/eval chains and off-site forms.

Peel Base64, hex, URL encoding, gzip and deflate layers until readable text remains.

Identify a file by its magic bytes and flag extensions that lie about the real format.

MD5, SHA-1 and SHA-256 of any file, with ready VirusTotal and MalwareBazaar search links.

Compute a site's mmh3 favicon hash with ready Shodan, FOFA, ZoomEye and Censys queries.

Decode a PEM certificate: subject, SAN list, issuer, validity and fingerprints.

Find digital signature markers in a PDF and show the signer name, reason and location.

Convert a file to a Base64 data URI, or paste a data URI and download the decoded file.

Generate decoy BIP39 phrases to flood seed-phishing forms. It never takes a real phrase.

See what a wallet signature really approves: EIP-712, calldata, permit and Permit2.

Compare your history with the address you meant to pay and spot poisoned lookalikes.

Validate EIP-55, Bitcoin, TRON and Solana addresses and show the correct checksum form.

Check up to 20 crypto addresses against PhishDestroy's database of phishing wallets.

Build abuse reports for registrars, hosting providers and CDNs, as an email and as JSON.

Find the registrar and network abuse contacts for a domain or IP from RDAP.

Turn a list of IOCs into STIX 2.1, MISP JSON, CSV, Suricata rules or a YARA skeleton.

Turn domains and URLs into hosts, AdGuard, Pi-hole, RPZ, dnsmasq or Unbound blocklists.

Black out or pixelate personal data on a screenshot; the PNG never leaves your browser.

Bundle a URL, source, UTC time and file SHA-256 into one checkable JSON record.

Save and find copies of a page in the Wayback Machine and archive.today, minus trackers.

Defang or refang URLs, IPs and emails (hxxps, [.], [at]) and extract IOCs from raw text.

Generate an RFC 9116 security.txt with Contact, Expires, Canonical, Policy and more.

Check a password against Have I Been Pwned; only 5 characters of its SHA-1 are sent.

Two questions about a suspicious link, email, SMS or QR code, then what to check and do.

Turn a Chrome, Edge or Firefox extension ID into store links and a permissions guide.

Random passwords from letters, digits and symbols via crypto.getRandomValues.

Encrypt and decrypt text with AES-256-GCM in your browser, keyed by a passphrase.

Memorable passphrases of 4 to 8 random words from the BIP39 English list.

Live six-digit TOTP codes for a Base32 secret (RFC 6238), or a new random secret.