HTTP Security Header Tool

See how response headers change browser behaviour

HTTP response headers control important browser security features, and getting them right or wrong has real consequences. This tool lets you paste headers to see how they affect browser security, so you understand what protections your headers enable or leave off.

The headers that matter

A handful of security headers do heavy lifting: a Content-Security-Policy constrains what a page can load and run, blocking many injection attacks; Strict-Transport-Security forces HTTPS; X-Content-Type-Options stops content-type sniffing; and others govern framing and referrer leakage. Each is off unless you set it, so a site without them relies on defaults that are weaker than they could be. Seeing how your headers map to browser protections shows what you have enabled and what you are missing.

Harden the response

The tool runs entirely in your browser, so nothing you paste is uploaded, which is exactly what you want when the input is your own security-sensitive data.

Related tools

• Password Strength Checker — Measure password strength by entropy and pattern analysis rather than character-class rules. Checked entirely in your browser.
• Password Generator — Generate strong random passwords and passphrases in your browser using the Web Crypto API. Nothing is transmitted, logged or stored.
• Hash Generator — Generate MD5, SHA-1, SHA-256 and SHA-512 hashes in your browser. Compare checksums and verify file integrity with nothing uploaded to a server.
• Base64 Encoder/Decoder — Encode and decode Base64 in your browser, including URL-safe Base64 and UTF-8 text. Handles files and data URIs locally with nothing uploaded.