Everything we have shipped, newest first. New tools land regularly — check back or bookmark this page.
Our most in-depth privacy tool yet: it shows the complete fingerprint your browser exposes to every website — user agent and Client Hints, screen and hardware details, time zone, installed fonts, and the canvas, WebGL and audio fingerprints trackers use to recognise you without cookies. It even checks for WebRTC local-IP leaks and computes a combined fingerprint hash. Everything except your IP is gathered in your browser and never uploaded.
Instantly see the public IP address every website sees for your connection, along with its type, reverse DNS name, and the network (ASN) and country it belongs to.
Paste any User-Agent string — or use your own — and break it down into browser, rendering engine, operating system, device type and architecture.
See the exact HTTP headers your browser sends with every request, before any JavaScript runs, revealing what sites learn about your language, platform and preferences from the very first byte.
A proper theme toggle now lives in the header. Pick light or dark to suit your eyes or your environment and the site remembers your choice, independent of your operating system setting.
Fetch any page and inspect its title, meta description, canonical, robots and Open Graph / Twitter Card tags, with a preview of how it would appear when shared on social media.
Turn an IPv4 or IPv6 address back into its PTR hostname — essential for diagnosing mail-server reputation and confirming forward-confirmed reverse DNS.
Trace a URL through its entire chain of 301, 302, 307 and 308 redirects to the final destination, with the status code at every hop.
Convert an IPv4 address between dotted, decimal, hexadecimal and binary forms, or expand and compress IPv6 addresses.
Turn any text or URL into a QR code with adjustable size and error-correction, then download it as a crisp PNG or scalable SVG — all in your browser.
Write Markdown and watch it render to clean, safe HTML in a live side-by-side preview, with the sanitized HTML source ready to copy.
Convert JSON arrays of objects into CSV — and CSV straight back into JSON — with your choice of delimiter, all client-side so your data never leaves the page.
Switch between JSON and YAML in either direction, handy for editing Kubernetes, Docker Compose and CI configuration files.
Convert XML to JSON and back, preserving attributes and repeated elements, right in your browser.
Encode an image into a Base64 data URI — with ready-to-paste HTML and CSS snippets — or decode one back into a downloadable image, without ever uploading the file.
Encrypt or decrypt text with AES-256-GCM and a passphrase using the browser Web Crypto API, so your secrets are processed entirely on your own device.
Convert Unix file permissions between the checkbox grid, the symbolic string (rwxr-xr-x) and the octal number (755), with the matching chmod command.
Convert a date and time between world time zones with automatic daylight-saving handling, plus a live world clock for that instant.
Compare two blocks of text side by side with word-level highlighting and per-line numbers, correctly handling moved and reflowed passages.
Count words, characters, sentences and paragraphs, with an estimated reading time, as you type.
Turn any title or heading into a clean, lowercase, URL-friendly slug in one click.
Generate placeholder paragraphs, sentences or words to fill out designs and mock-ups.
Convert text between UPPERCASE, lowercase, Title Case, camelCase, snake_case and kebab-case instantly.
Convert colours between HEX, RGB and HSL with a live preview swatch.
Encode or decode HTML entities so special characters display correctly and safely in markup.
Convert numbers between binary, octal, decimal and hexadecimal.
Decode a JSON Web Token to inspect its header and payload, and verify HMAC (HS256/384/512) signatures with a secret.
Compute an HMAC signature (SHA-256/512, SHA-1 or MD5) from a key and message.
Generate a bcrypt password hash or check a password against an existing hash, the same way a login system does.
Estimate how strong a password is by its entropy and see roughly how long it would take to crack.
Translate a cron expression into plain English and list its upcoming run times.
Test a regular expression against sample text, see every match and capture group, or run a find-and-replace.
Generate UUID v4 (random) or v7 (time-ordered) identifiers in bulk.
Create strong random passwords with adjustable length and character rules.
Compute MD5, SHA-1, the SHA-2 and SHA-3 families, RIPEMD-160 and CRC32 checksums of any text.
Convert between Unix timestamps and human-readable dates in both directions.
Encode text to Base64 or decode it back, quickly and safely.
Percent-encode or decode URLs and query-string values.
Pretty-print, validate or minify JSON, with clear error messages when it is malformed.
Work out network and broadcast addresses, masks, host ranges and counts from any IPv4 CIDR block.
Convert internationalised domain names between Unicode and their punycode (xn--) representation.
Inspect a site TLS certificate: issuer, validity dates, key type and size, SANs, fingerprint and whether the chain is trusted.
View any URL response headers and follow its redirect chain.
Grade a site on HSTS, Content-Security-Policy, X-Frame-Options and other important security headers.
Test whether common or custom TCP ports are open on a host.
Look up the reverse DNS, ASN, network and country for any public IP address.
Fetch a domain SPF record and recursively count its DNS lookups against the 10-lookup limit, showing the full include chain.
Read and explain a domain DMARC policy, including alignment, percentage and reporting settings.
Look up a DKIM public key by selector and report its exact key size.
Validate an email address by syntax, domain MX records, and role or disposable detection, with a live mailbox probe.
Paste raw email headers to trace the delivery path and spot delays hop by hop.
Check a DNS record across 14 public resolvers in the US and around the world to see how far a change has propagated.
List a domain mail servers in priority order to confirm where its email is delivered.
Check whether an IP address appears on the major DNS blacklists (RBLs) used to fight spam.
Core Web Utilities is officially live — a fast, free, no-nonsense collection of web tools with no ads, no sign-up and nothing you enter stored. We are starting with the essentials and adding more every few days. Here is where it all began:
Look up a domain registration, registrar, key dates and nameservers with a live WHOIS query.
The tool it all started with: a dig-style DNS lookup for A, AAAA, MX, TXT, NS, SOA, SRV, CAA and PTR records, complete with a subdomain sweep.
