Tools

WHOIS lookup

DNS records

Email authentication (SPF, DMARC, DKIM)

Checks whether a domain is set up to stop others from spoofing its email.

Email header analyzer

Paste an email's raw headers to trace its path, see the delay at each hop, and read the SPF / DKIM / DMARC results. Parsed entirely in your browser; only the originating IP is looked up.

SSL / TLS certificate

Checks a site's certificate: who issued it, when it expires, which names it covers, the TLS version, and the CAA policy.

Security headers

Grades a site's HTTP security headers: HSTS, Content-Security-Policy, X-Frame-Options and more.

IP lookup

Location, network (ASN / organization) and reverse DNS for any public IP address.

Reverse DNS (PTR)

The hostname an IP address points back to.

ASN lookup

Find the network (autonomous system) behind an IP, or the address ranges an AS announces.

Subdomain finder

Subdomains seen in public TLS certificates (Certificate Transparency logs).

MAC vendor lookup

The hardware maker registered to a MAC address prefix (OUI).

Link / redirect expander

Follows a short or tracking link on our server and shows where it really goes -- without you clicking it.

Typosquat / look-alike check

Generates common misspellings of a domain and shows which are actually registered -- the ones a phisher could be using.

Inbound port scan

Scans common ports on your own public IP. Only you can run this against yourself.

Email breach check

Password strength & breach check

Runs entirely in your browser. Your password is never sent anywhere; only a short, anonymized slice of its hash is used to check breaches (k-anonymity).

Your request headers

Everything your browser sent with the request for this page -- the raw material behind a lot of tracking and fingerprinting. Cookie values are hidden.

Browser permissions

What this site could access right now -- checked silently, with no prompts. Permissions are per-site, so this reflects what you have granted to whoamionline.com.

Connection (browser estimate)

Your browser's own guess at your connection type and quality. Not a measurement -- run the Speed test for that. Chromium browsers only.

Defang / refang

Switch indicators between safe form (hxxp, 1[.]2[.]3[.]4, user[@]domain) for sharing and live form for use. Runs in your browser.

IOC extractor

Paste a log, email or report and pull out every IP, domain, URL, email, file hash and CVE -- deduplicated. Runs in your browser.

Multi-decoder

Base64, URL, hex, ROT13 and HTML-entity encode/decode. Runs in your browser.

Hash calculator

MD5, SHA-1, SHA-256 and SHA-512 of text or a file. The file is hashed in your browser -- it is never uploaded.

CIDR / subnet calculator

Network, broadcast, host range and size for an IPv4 CIDR block -- and whether a given IP falls inside it. Runs in your browser.

Timestamp converter

Convert between epoch (seconds / millis), ISO 8601 and Windows FILETIME. Auto-detects the input. Runs in your browser.

QR code generator

Turn text, a link, Wi-Fi details or a contact into a QR code, built entirely in your browser. Pick a type, then export as PNG, JPG, TIFF or PDF.

Host intelligence

Open ports, software (CPEs) and known CVEs seen on a public IP -- from passive internet-scan data (Shodan InternetDB). No active scanning.

CVE lookup

CVSS severity, description, weaknesses and references for a CVE ID, straight from the NVD.

Threat reputation

Check a file hash, domain, IP or URL against the abuse.ch ThreatFox and MalwareBazaar databases. The indicator you enter is sent to abuse.ch.