Privacy

Short version: there is no database, and we do not keep your scans.

No accounts, no database

This tool has no user accounts and no database. Reports are not persisted server-side. When you share a report, the result is encoded into the link itself — nothing is stored by us.

What the URL scan does

When you scan a URL, a stateless server function fetches only the response headers (and, over HTTPS, the certificate metadata and /.well-known/security.txt) of the target, then returns them to your browser, which does the analysis. The target URL is not written to a database and is kept out of persistent logs.

Paste mode is fully local

In "Paste headers" mode nothing leaves your browser at all — parsing and grading happen entirely on your device. Use it for internal, staging or authenticated sites.

DNS, WHOIS and TLS

DNS/email checks are made from your browser to Cloudflare's public DNS-over-HTTPS resolver; WHOIS uses the public RDAP network (rdap.org). Those third parties see the domain you look up, under their own privacy policies. We store none of it.

Cookies & analytics

We set no cookies and run no cross-site tracking.