Windows apps
Take them one at a time
Each is its own small program with one job, so you install the one you need and nothing else. Every one of them also runs in your browser over on the tools page. The reason to install instead: a program on your own machine can look at your own network, and a website — quite rightly — cannot.
Grader
Free · full report EUR 19Grades a site or server on headers, TLS, cookies and email authentication. The desktop version will scan internal hosts — your domain controller, your NAS, the intranet box — which the web version refuses by design.
Download · 12 MBWatchtower
Free 5 assets · EUR 29 unlimitedWatches certificates and domain registrations and warns at 30, 14 and 3 days. Runs as a scheduled task and notifies through Windows. Your asset list never leaves the machine.
Download · 12 MBPhishing Analyser
FreePaste a suspicious email and get a verdict: forged sender, failed DMARC, look-alike domains, links that lie about where they go. Works with no connection at all and stores nothing.
Download · 10 MBPowerShell Generator
FreeFourteen reviewed scripts for Active Directory, Exchange and Microsoft 365. Everything that changes state is generated with -WhatIf on and the destructive line commented out. It never executes anything.
Password Check
FreeChecks a password against billions of leaked ones without ever sending it — only the first five characters of its hash leave the machine, and the match is made locally.
Download · 11 MBDNS Propagation
FreeAsks eight public resolvers the same question at once and shows where they disagree — plus what your own resolver says, which on a VPN is usually the answer to why it works for everyone else.
Download · 10 MBSubnet Calculator
FreeIPv4 and IPv6. Range, usable hosts, splitting into equal subnets and fitting a host count. Handles /31 and /32 properly. Entirely offline.
Download · 10 MBIR Plan Builder
FreeBuilds a short, specific incident response plan for ransomware, account takeover, data exposure and more — ordered so evidence survives containment. Exports to PDF.
Download · 10 MBWindows 10 and 11, 64-bit. No account, and nothing you check is sent to us. These installers are not code-signed yet, so Windows SmartScreen will show a warning the first time — click More info then Run anyway. Verify what you downloaded against SHA256SUMS.txt if you would rather check than trust.
Tools
Eight tools we built for ourselves.
These are the checks we run before we take a client on, and the scripts we got tired of writing by hand. Install them as Windows apps, or use them right here in the browser. No account either way, and nothing you type is stored. Two have a paid tier — said plainly on the tool rather than discovered halfway through.
Website security grader
Headers, TLS, email authentication, cookies and disclosure. No port scanning — everything checked here is something the server publicly offers to any browser, so every finding can be confirmed by hand.
Phishing email analyser
Paste a suspicious email. Include the full headers if you can — in most clients that is More → Show original. Nothing is stored: it is parsed in memory and discarded.
SSL & domain expiry
Certificates and domain registrations, and how long each has left. Five assets free; Watchtower stores them, re-checks weekly and warns at 30, 14 and 3 days.
Keep watching them
A one-off check tells you about today. Watchtower re-checks every week and writes to you only when something crosses a line — 30, 14 and 3 days before an expiry, the moment a certificate stops validating, and whenever MX, SPF, A or NS records change. Weeks with nothing to report are silent.
The domains above are used. We send one email to confirm the address is yours — nothing is watched and nothing else is sent until you click it.
PowerShell script generator
Ready-to-review scripts for the jobs that eat an afternoon. Anything that changes state previews first and ships with the destructive line commented out.
Password leak check
Find out whether a password appears in known breaches. Your password is hashed in this browser and only the first five characters of that hash are sent — neither we nor HaveIBeenPwned ever see the password itself.
DNS propagation
Ask eight public resolvers the same question and see where they disagree — the fastest way to tell whether a DNS change has spread yet.
Subnet calculator
CIDR in, everything out. Runs entirely in the browser, so it still works with no signal once the site is installed as an app.
Incident response plan
Answer these and get a written plan you can print. Everything stays in your browser — none of it is sent anywhere.
How these behave
What happens to what you type
Get in touch
Tell us what you are running
Whether it is one mailbox or a whole office, send us a line about your current setup and we will come back with a straight answer and a price.