Security headers and trust boundaries
Review supplied response security headers locally, preserving CSP policy boundaries and explicit limits without uploading headers or issuing a security score.
Local browser processing; no input uploads
NETWORK SPEED TESTER
Authentication and browser security tools
Available authentication and browser security with controlled execution, clear measurement limits and no automatic test traffic.
JWT trust inspection
Inspect JWT claims locally and verify RS256 or ES256 signatures against an independently supplied public JWK and explicit claim policy.
Local browser processing; no input uploads
Cookie policy inspection
Review supplied Set-Cookie declarations locally, including Secure, HttpOnly, SameSite, Partitioned and prefix requirements without reading the browser cookie store.
Local browser processing; no input uploads
Cross-origin isolation
Observe actual browser cross-origin isolation and dependent capability availability locally, or inspect a redacted capture from an authorised document.
Local browser processing; no input uploads
Choose the test that matches the question
Deployment Regression compares captures from the same owned-build HTTP and UI fixtures; changed bytes alone are not a regression. Cache Coherence checks read-only local CacheStorage and compares unverified release markers; it does not probe CDN freshness. Cross-origin isolation observes actual browser capability flags without claiming security conformance. Cookie policy inspection reviews supplied Set-Cookie declarations locally without reading the cookie store. Security-header inspection reviews supplied declarations locally, without a security score or upload. Resource waterfall inspects retained timings or a local redacted capture. Asset integrity compares listed public files with their generated build manifest. Connection speed measures application goodput. Upload responsiveness compares response time while a bounded transfer competes. Location comparisons require controlled repeat runs. WebSocket resilience checks heartbeat echoes across a continuous socket or one deliberate clean reconnect. SSE stability validates an event sequence continuously or across one planned application-stream interruption. JWT inspection decodes and optionally verifies supplied tokens locally, without an upload. The developer inspector checks our own signed HTTP response; it is not an arbitrary-URL API client.
Only implemented capabilities are linked here. Planned DNS, TLS, CORS, authentication and application-failure tools are not advertised as runnable utilities. Several capabilities intentionally share an existing test view.