# Free security tools

> Seven free security tools that run entirely in your browser: link checker, password strength, QR scanner, email header analyzer, JWT decoder and more.

Canonical: https://www.phishclean.com/tools
Last updated: 2026-11-01

Every tool runs entirely in your browser. Your data is never sent to us. The coding test checker reads repos straight from GitHub, GitLab or Bitbucket.

100% private — your data is never sent to us

- [Phishing Link Checker](https://www.phishclean.com/check-link): Most popular Paste any suspicious URL to check for domain spoofing, suspicious TLDs, token leaks, punycode tricks, and 10 more phishing signals. Check a link
- [Password Strength Checker](https://www.phishclean.com/tools/password-checker): Test any password for entropy, common patterns, dictionary words, keyboard walks, and estimated crack time. Real-time analysis as you type. Test a password
- [QR Code Scanner](https://www.phishclean.com/tools/qr-scanner): Upload a QR code image or use your camera to decode it. If it contains a URL, we automatically check it for phishing signals. Scan a QR code
- [Phishing Email Checker](https://www.phishclean.com/tools/phishing-email-checker): Paste a suspicious email to scan for urgency language, threat tactics, spoofed links, credential requests, and social engineering patterns. Check an email
- [Email Header Analyzer](https://www.phishclean.com/tools/email-header-analyzer): Paste raw email headers to trace the real sender, view relay hops, and check SPF, DKIM, and DMARC authentication results. Analyze headers
- [JWT Decoder](https://www.phishclean.com/tools/jwt-decoder): Paste a JSON Web Token to decode its header, payload, and signature. Flags expired tokens, weak algorithms, and sensitive data in claims. Decode a JWT
- [Backlink Impersonation Checker](https://www.phishclean.com/tools/backlink-impersonation-checker): Paste a page URL and HTML to test the same extension signal that catches fake pages borrowing trust from real brand assets, privacy links, and support pages. Test backlink signals
- [Coding Test Checker](https://www.phishclean.com/tools/coding-test-checker): New Paste the repo a recruiter sent you. See whether npm install or opening it in VS Code would run hidden code. The files are read straight from GitHub, GitLab or Bitbucket. Check a repo

## Why these run in your browser

Every tool on this page is plain JavaScript executing on your own machine. Nothing you paste — a URL, a password, an email header, a token — is uploaded, logged or stored anywhere. You can confirm it yourself: open your browser's Network tab and run any tool on this page, and you will see that no request leaves it.

That design has a practical payoff beyond privacy. Because there is no server in the loop, these tools work on internal URLs, staging environments and intranet pages that a hosted scanner could never reach. There are no rate limits, no queue, and no account to create.

The trade-off is that they only inspect what you hand them. They cannot see the page you are actually on — which is exactly what the extension is for: the same class of checks, running automatically against every page you visit.

## These tools check what you paste. The extension protects you everywhere.

PhishClean monitors every page you visit in real time — catching phishing pages, token leaks, and credential theft before they happen.

[Install PhishClean free](https://www.phishclean.com/#install)

Last updated: 1 November 2026