Home  /  Tools
Free Security Tools

Tools I built because I needed them

Every tool here came out of real work securing and migrating enterprise applications — WAF tuning, CDN cutovers, certificate churn, and bulk changes across F5 Distributed Cloud tenants. They're free, most run entirely in your browser, and none of them ask you to create an account or hand over a secret.

Client-side by default

Private keys, zone files, and payloads are processed in your browser. Where a server is unavoidable, it acts as a pure proxy and stores nothing.

No sign-up, no upsell

No account, no email wall, no trial that expires. If a tool is listed here, it works end-to-end for free.

Built from production work

Not demos. Each one solved a problem that came up while delivering security and delivery projects for large enterprises.

The Library

A small, curated set — added to only when there's a genuine gap worth filling, not to pad a list.

TLS & PKI

FreeSSL

Free Let's Encrypt SSL/TLS certificate generator

Issues real Let's Encrypt certificates without ever exposing your private key. The account keypair and CSR are generated in your browser with the Web Crypto API; only the public key reaches the network. The server is a pure ACME proxy — it stores no keys, no email addresses, and no domain names.

  • Wildcard and multi-domain (SAN) certificates
  • DNS-01 validation for domains without public HTTP
  • Private keys generated via window.crypto.subtle, never transmitted
  • Certificate delivered from Let's Encrypt straight to your browser
  • Documented step-by-step key flow, so you can verify the claims
Why it exists: most "free SSL" sites generate your private key on their server — which means trusting a stranger with the one secret that matters. This one is built so that trust isn't required.
Let's Encrypt ACME Web Crypto API Client-side keys
DNS

BindGen

DNS zone file converter & RFC validator

Converts zone files between Cloudflare exports, F5 DNS exports, and standard BIND format, validating RFC 1034/1035 compliance as it goes. It flags the errors that actually break migrations — CNAME conflicts above all — and can auto-fix them before you import.

  • Cloudflare ↔ F5 DNS ↔ standard BIND, with format auto-detect
  • Detects and auto-fixes CNAME conflicts
  • Validates TTL, SOA, NS, MX and TXT records
  • Upload a file or paste the zone contents directly
  • Export as .zone or .zip ready for import
  • 100% client-side — zone data never leaves the browser
Why it exists: provider migrations fail on small RFC violations that the source provider tolerated and the destination rejects. Catching them before the cutover is far cheaper than debugging resolution failures afterwards.
BIND Cloudflare F5 DNS RFC 1034/1035
WAF Testing

WAF Security Tester

Verify your WAF blocks what you think it blocks

Sends classic attack payloads at a target you control and shows you exactly what came back — status, headers, and body. Requests go directly from your browser to the target, so there's no backend collecting your endpoints or results.

  • Payload categories: SQL injection, XSS, command injection, path traversal, Log4Shell
  • Single-request mode with full request/response inspection
  • Bulk mode to sweep multiple payloads across categories
  • GET or POST, custom parameter name, configurable timeout
  • Response breakdown by overview, headers, and body
Why it exists: a WAF policy that looks correct in the console isn't proof. The fastest way to find a gap — or an over-aggressive rule generating false positives — is to send the payload and read the response.
OWASP payloads Log4Shell No backend Bulk testing
CDN & Origin

HTTP Spoof Tester

Compare live CDN responses against your origin, side by side

For each URL it fires two requests in parallel: one through normal public DNS (the live CDN path) and one sent straight to an IP you specify, carrying the original domain in the Host and SNI headers. Then it diffs them — status, headers, and body — so you can see what the CDN is changing, and whether your origin answers for hostnames it shouldn't.

  • Host-header + SNI spoofing directly against a target IP
  • Pass/fail on live-vs-spoofed status match
  • Fuzzy HTML body similarity with scripts and styles stripped out
  • Detects bot challenges and WAF block pages
  • Full header diff with CDN noise auto-filtered
  • CSV or URL mode for bulk runs, plus CSV export of the report
Why it exists: before a CDN cutover you need to know the origin responds correctly — and after it, you need to know the origin isn't still reachable directly. Both questions are answered by the same test, and nothing off-the-shelf did it cleanly.
Host header spoofing CDN migration Origin exposure Akamai debug headers
F5 Distributed Cloud

XC BulkOps

Bulk operations toolbox for F5 Distributed Cloud

Eleven operations for people who administer F5 Distributed Cloud at scale, where the console's one-object-at-a-time workflow stops being practical. Every destructive action is wrapped in safety rails: automatic backup, a dry-run preview, and a before/after diff you approve before anything is written.

  • Config Visualizer, Config Sync, and Security Auditor for review
  • LB Forge, CDN Factory, and Prefix Builder for bulk creation
  • Policy Pusher, Threat Toggle, and Identity Roller for fleet-wide changes
  • WAF Status Scanner and Log Harvester for posture and evidence
  • Backup Vault, dry-run preview, before/after diff, and rate limiting throughout
Why it exists: applying one policy change across dozens of load balancers by hand is slow and easy to get wrong. Automating it is only safe if you can preview the change and roll it back — so those came first.
F5 XC Bulk automation Dry run Auto-backup

Missing a tool you keep rebuilding by hand?

This library grows deliberately — a new tool gets built when the same problem shows up often enough to be worth solving properly. If you're working around a gap in WAF, API, DNS, CDN, or certificate tooling, tell me what it is.