Every tool here answers one question and tells you what to do about the answer. Nothing is locked behind an account, and each page explains what the result means in plain English.
Find every known data breach that includes your email address, see exactly what was taken, and get a plan in the right order.
Your address is looked up and stored only as a one way hash plus a masked copy. It is never sold or added to a mailing list.
See how long your password would really survive an attack, and whether that exact password is already on a breach list.
Strength is calculated on your device. The leak check sends only the first five characters of a hash, never the password.
Create a strong random password, a memorable passphrase or a PIN, generated on your device and never sent anywhere.
Generated entirely in your browser using its cryptographic random source. Nothing is transmitted or stored.
Paste a suspicious link and see where it really goes, which tricks it uses, and what to do, before you click.
The link is analysed in your browser and never opened. Only the host name is sent, and only if you run the domain check.
Paste a suspicious text, email or DM and find out whether it matches a known scam script, with every link checked.
The message is analysed entirely in your browser. Nothing you paste is sent to our server, and no link inside it is opened.
Photograph a QR code before you open it and see exactly where it leads, what it does and whether it is a scam.
The photo is decoded on your device and never uploaded. The contents are shown as text and nothing inside the code is opened.
Paste an email's raw headers to see where it really came from, whether it passed SPF, DKIM and DMARC, and whether replies would go somewhere else.
Headers are parsed and judged in your browser. Nothing you paste is uploaded or stored.
Find out whether criminals can send email that looks like it comes from your domain, and exactly which DNS records fix it.
Only the domain name is sent. DNS records are public information and the check reveals nothing about you.
Remove your name, address and phone number from people search sites, in the right order, and get reminded when listings come back.
Your progress stays in this browser, or in your account if you sign in. We never submit anything to brokers on your behalf.
Write a legally worded request to delete, access or stop the sale of your data, with the deadline and a follow-up letter.
The letter is written in your browser and your name, email and details are never sent to us. The tracker saves only company names, dates and statuses, in this browser and in your account if you are signed in.
Answer 20 quick questions about your passwords, phone, devices and accounts to get a score out of 100 and the fixes that matter most for you.
Your answers are scored in your browser and are not sent anywhere unless you sign in and choose to save your score.
Find out what someone can do with your phone number and work through the steps that stop SIM swaps, spam and account takeovers.
Your number is checked for format in your browser and shown masked. It is not stored.
Find out whether this device can use passkeys, where yours would be stored, and which accounts to switch first.
The device check asks your browser three yes or no questions and nothing else. Your answers stay in this browser. Nothing is sent to our server.
Answer a few questions about a call or voice message and see whether it follows a known scam script, with exactly what to do next.
Your answers are scored in your browser and are never sent anywhere. The family code word is made on your device.
See which sites have a public profile under your username, what each one shows, and how a reused handle links your accounts together.
The username is sent to our server, which asks each site's public API whether that profile exists. Nothing is stored, and results are cached for an hour only to respect each site's limits.
Yes. Every tool on this page is free with no account and no usage limit for normal personal use. The site earns money from clearly labelled links to paid protection services, never from the tools themselves.
The password tools, the link checker, the email header analyzer and the privacy quiz run entirely inside your browser. Breach checks and domain checks are sent to our server because they need an outside lookup, and each tool page says exactly what leaves your device.
Start with the email breach check. It tells you which of your accounts are already exposed, which decides what you fix first.