Free, browser-based tools for security analysts — defang and extract indicators, decode and hash, do subnet and timestamp math, and enrich IPs, CVEs and file hashes. No account, no cost, and the indicator-handling tools run entirely in your browser.
Built for the way analysts actually work
Whether you sit in a SOC, run incident response, triage phishing or track threat actors, a lot of the day is the same handful of repetitive jobs: pull the indicators out of a log or email, flip them between defanged and live form, decode an obfuscated string, hash a sample, work out whether an IP sits in a given range, convert a timestamp, and enrich what you’ve got. These tools cover that common 80% — fast, with no setup and nothing to install.
Your indicators stay in your browser
Pasting a live command-and-control domain or a malware hash into an unknown website is a real operational-security risk — it can tip off an adversary or leak an investigation. That’s why the six IOC-handling tools below run entirely client-side: the text and files you give them are processed by JavaScript in your own tab and are never uploaded to our server or anywhere else. We don’t log your inputs because we never receive them.
In-browser tools (nothing leaves your tab)
- Defang / refang — switch indicators between safe form (
hxxp://,1[.]2[.]3[.]4,user[@]domain) for sharing and live form for use. - IOC extractor — paste a log, email or report and pull out every IP, domain, URL, email address, MD5/SHA-1/SHA-256 hash and CVE, deduplicated, with one-click defanged copy.
- Multi-decoder — Base64, URL, hex, ROT13 and HTML-entity encode and decode.
- Hash calculator — MD5, SHA-1, SHA-256 and SHA-512 of text or a file. A dropped file is hashed in your browser, so you can fingerprint a sample without uploading it.
- CIDR / subnet calculator — network, netmask, wildcard, broadcast, host range and count for an IPv4 block, plus whether a given IP falls inside it.
- Timestamp converter — convert between epoch (seconds / milliseconds / microseconds), ISO 8601 and Windows FILETIME, with auto-detection.
Free enrichment lookups
These send the indicator you enter to a reputable public source, so they’re meant for already-public or suspected-bad indicators — each one says plainly where your query goes.
- Host intelligence — open ports, detected software (CPEs) and known CVEs for a public IP, from passive internet-scan data (Shodan InternetDB). No active scanning.
- CVE lookup — CVSS severity, description, weaknesses (CWE) and references for any CVE ID, straight from the National Vulnerability Database.
- Threat reputation — check a hash, domain, IP or URL against the abuse.ch ThreatFox and MalwareBazaar databases.
The rest of the network toolkit
The same Tools page also carries the OSINT and infrastructure lookups analysts reach for constantly:
- WHOIS and DNS records (A/AAAA/MX/TXT/NS/CNAME)
- SSL/TLS certificate inspection and a security-headers grader
- Email authentication (SPF / DMARC / DKIM / MX health) and an email header analyzer that traces the Received chain and per-hop delays
- Reverse DNS, IP lookup (geo + ASN + org) and ASN lookup
- Subdomain finder (Certificate Transparency), typosquat / look-alike checker and a link / redirect expander
Who it’s for
SOC analysts triaging alerts, incident responders building timelines, phishing and email-security analysts reading headers and expanding links, and threat-intelligence analysts enriching and pivoting on indicators. If you live in a SIEM and VirusTotal all day, think of this as the quick, private scratchpad for the one-off jobs in between — defang a line, pull the IOCs out of an email, decode a blob, hash a file, check a CVE.
No account, no logging, no cost
Nothing here asks you to sign in, and the in-browser tools keep your indicators on your device. Open the toolkit →