Free tools
Network & DevOps tools
59 tools you use daily. Server-side checks (DNS, SSL, mail, security, broken links, Core Web Vitals, GDPR …) plus pure browser helpers (JWT, JSON, regex, cron, encoder, UUID). No signup, no cookies, no personal tracking.
IP & network
14What is my IP address?
Shows your public IPv4/IPv6 with location, provider, ASN and reverse DNS — straight from your browser request.
Reverse IP lookup
Finds hostname (PTR) and geo/ISP for any public IP address. Useful for identifying server requests in logs.
Subnet calculator (CIDR)
From CIDR (192.168.1.0/24): network address, broadcast, mask, first/last host. Full IPv4 and IPv6 support.
ASN lookup
Finds the ASN, provider, country and IP range for any public IP via Team Cymru.
IP blacklist check
Probes IPv4 against 16 public DNSBLs (Spamhaus ZEN, Barracuda, SpamCop, CBL/Abuseat, UCEPROTECT …).
IP address check
Full IP profile: location (with accuracy radius), ASN/provider/RIR, time zone, currency plus VPN, Tor and risk signals. Auto-detects your own IP.
VPN & proxy detection
Clear traffic-light signals for VPN, Tor exit, iCloud relay, satellite and hosting IPs — plus abuse score, risk, ASN and country. Signals, not forensic certainty.
Data center or residential?
Detects whether an IP comes from a data center/hosting network (server/bot) or a residential line (real visitor) — incl. cloud provider, connection type and ASN.
Reverse DNS / PTR lookup
Resolves the PTR hostnames of an IP plus ASN, provider and country. Useful for FCrDNS checks and classifying requests in server logs.
Time zone & country by IP
Time zone with offset and local time, DST status, calling code, currency, official languages, continent and EU membership for an IP — as an estimate.
IP reputation & abuse score
Reputation estimate for an IP: abuse score from 0 to 100, risk level plus VPN, Tor, hosting and bogon signals with ASN/RIR context. Signals, not a verdict.
Bulk IP geolocation
Up to 50 IP addresses or log lines at once — country, city, ASN/ISP, VPN/hosting and abuse signals in one table, with in-browser CSV export.
ASN & network lookup
Resolve an IP, CIDR block or AS number to organization, provider domain, network prefix, RIR plus hosting and abuse signals.
Bogon & anycast check
Checks whether an IP comes from a bogon range (reserved/unallocated) and whether it is operated via anycast — with explanation plus ASN and RIR context.
DNS & domain
5DNS lookup (multi-resolver)
Compares A/AAAA/MX/NS/TXT/CAA records side-by-side at Google, Cloudflare and AdGuard. Surfaces geo-split DNS and propagation lag.
Whois/RDAP lookup
Returns registrar, creation/expiry dates, status flags, nameservers and (where public) owner via RDAP — structured, GDPR-compliant.
DNSSEC validator
Checks DNSKEY, DS records in parent zone and AD bit (authenticated data). Shows KSK/ZSK + algorithm.
DNS propagation multi-region
6 global JSON-DoH resolvers in parallel (Cloudflare, Google, AdGuard, NextDNS, AliDNS, DNS.SB).
Subdomain finder (passive via crt.sh)
Lists all known subdomains from certificate transparency logs — without contacting the target host.
SSL & security
4HTTP header inspector
Fetches your URL live and shows all response headers. Instantly grades 9 security headers (HSTS, CSP, X-Frame-Options …).
SSL/TLS inspector
Inspects certificate, issuer chain, validity, SAN, cipher suite, TLS version and HSTS. Warns when expiry is within 30 days.
Security header score (A–F)
Grades 9 important HTTP security headers (HSTS, CSP, X-Frame-Options, COOP …) with a weighted school grade.
Tech stack detector
Detects CMS, frameworks, server software and technologies of a website based on HTTP headers and HTML patterns.
Email deliverability
6Mail server check
Checks MX, SPF, DMARC and probes 61 DKIM selectors on a domain. Grades deliverability and surfaces gaps.
Email header analyzer
Parses a full email header in your browser: received hops, SPF/DKIM/DMARC, phishing hints.
DMARC/DKIM/SPF validator
Checks SPF, DKIM and DMARC of a domain via DNS lookup. Grades email authentication and surfaces gaps.
BIMI validator
Checks BIMI DNS record and logo URL of a domain. BIMI displays brand logos next to emails in Gmail, Apple Mail and Yahoo.
MTA-STS checker
Checks MTA-STS configuration of a domain: DNS record, policy file and TLS-RPT. Protects against downgrade attacks.
Email header analysis
Analyze raw email headers: presumed origin IP with geo and risk estimate, the chain of received hops plus SPF/DKIM/DMARC if present.
Performance & SEO
12Speed test
Measures download, upload, latency and jitter from your browser to EU servers in Germany.
Ping test
20 pings with live visualization: min, avg, max, jitter and packet loss to EU servers.
Pagespeed test (server-side)
3-run RTT measurement: connect, TLS handshake, TTFB, total. Shows HTTP/2 and gzip/brotli status — no browser render.
robots.txt + sitemap validator
Validates robots.txt syntax and referenced sitemap.xml — prerequisite for clean indexing.
Open Graph & social preview
See how Facebook, X, LinkedIn and WhatsApp will render the link to your page.
Resource waterfall
Waterfall chart of all resources: HTML, CSS, JS, images, fonts. DNS/TCP/TLS/TTFB per resource + third-party analysis.
HTTP status code reference
Searchable reference of all HTTP status codes with descriptions. From 1xx to 5xx — each code with practical explanation.
Broken link checker
Crawls a URL, extracts all hyperlinks and checks their HTTP status in parallel. Broken links (4xx/5xx) at a glance.
Redirect checker
Shows the complete redirect chain of a URL — every hop with HTTP status code and Location header.
Core Web Vitals (CrUX)
LCP, CLS and INP from real Chrome user data (CrUX). 75th percentiles — the experience 75% of your visitors have.
Sitemap validator (XML)
Loads an XML sitemap, validates format, counts URLs and detects issues like oversized sitemaps or malformed XML syntax.
Is my site AI-ready?
Checks AI-crawler permission (robots.txt), llms.txt, structured data and sitemap — yields an AI-readiness score from 0 to 100.
Compliance & privacy
6GDPR cookie scanner
Fetches your page without consent and lists third-party domains and pre-consent cookies, categorised.
Imprint checker (§ 5 DDG)
Checks your imprint page for completeness of mandatory information per § 5 DDG. Entirely in the browser — no server transfer.
BFSG accessibility check
Automated WCAG 2.2 test. Finds missing alt texts, form labels, insufficient contrast and missing landmarks.
Privacy policy crawler (GDPR)
Checks a privacy policy for GDPR mandatory sections: controller, legal basis, data subject rights and more.
Google Fonts check
Checks if a website loads Google Fonts externally — GDPR risk since the LG Munich ruling (Az. 3 O 17493/20).
Consent checker (pre-consent)
Tests if a website loads trackers and cookies before consent. Finds pre-consent tracking violations.
Developer tools
12JWT decoder
Decodes header, payload, signature of any JSON Web Token in your browser. Validates exp/iat/iss/aud. Optional HS256/RS256 signature verification.
JSON formatter & validator
Pretty-prints, validates and minifies JSON in the browser. Shows syntax errors with line + column. Sorts keys alphabetically.
JSONL validator
Validates JSON Lines (JSONL/NDJSON) line by line. Shows invalid lines, key statistics and exports cleaned files.
Encoder & hash generator
Base64, URL encoding, MD5, SHA-1/256/512 and HMAC-SHA-256 in one tool. Fully in-browser via Web Crypto API.
UUID & ULID generator
UUID v4, UUID v7 (time-based, RFC 9562) and ULIDs. Bulk up to 10,000 IDs on click. Validator detects format and timestamp.
Password generator
Cryptographically secure passwords in your browser via Web Crypto API. Configurable length, char sets, bulk + entropy score.
A/B test sample size
Sample size + days-to-significance from baseline, MDE, α, power. Two-proportion z-test, entirely in your browser.
Regex tester
Test regular expressions in your browser with live highlighting of all matches, capture groups and named groups. All JavaScript flags supported.
Base64 image converter
Convert images to base64 data URIs via drag & drop — fully in your browser. Ideal for inline images in email templates or CSS.
Cron parser
Analyse cron expressions, compute the next 10 execution times and get a human-readable description — fully in your browser.
Online cURL tool
Send HTTP requests with any method, custom headers and body. Status, headers, timing and body directly in your browser.
robots.txt + llms.txt generator
Allow or block AI crawlers — generates ready-to-use robots.txt and llms.txt in the browser.
What we don't offer
Three common tool categories we leave out for reasons of proportionality:
Port scanner
External port probes against third-party hosts are legally sensitive in many jurisdictions. For port monitoring on your own systems, use our authenticated API-endpoint or service monitors instead.
Mail relay test
Active SMTP relay probes are often classified as attacks by spam filters and can land third-party IPs on blocklists. Our mail server check evaluates passively via DNS instead.
Network & DevOps tools — what this collection does
These 59 tools cover the most common daily tasks of DevOps engineers, site reliability engineers, backend developers and web admins — no signup, no cookies, no tracking. 44 are server-side checks: DNS, DNSSEC, SSL/TLS, mail (SPF/DMARC/DKIM/MTA-STS/BIMI), security header score, IP blacklist, whois/RDAP, pagespeed with web vitals, Core Web Vitals (CrUX), resource waterfall, broken link checker, redirect checker, sitemap validator, tech stack detector, BFSG accessibility check, privacy policy crawler, Google Fonts check, consent checker, cookie scanner, subdomain finder, Open Graph preview, AI readiness check, online cURL tool and ten geo tools. 15 are pure browser helpers: imprint checker, JWT decoder, JSON formatter, JSONL validator, encoder/hash, UUID generator, subnet calculator, email header analyzer, password generator, A/B test sample-size calculator, regex tester, base64 image converter, cron parser, robots.txt + llms.txt generator and HTTP status code reference — they never leave your machine and are safe for sensitive input like API keys or tokens. All tools are 100% EU-hosted, GDPR-compliant and built for diagnosing real production incidents, not just demo toys.
Typical use cases
- DevOps engineer mid-incident: mail server check + DNS lookup for fast triage of why emails started landing in spam 30 minutes ago
- SRE checks across five different edge locations whether a fresh SSL renewal is rolled out everywhere
- Backend developer debugs a "401 Unauthorized" with the JWT decoder — exp claim or missing audience?
- Web admin grades the security header posture of a client site before the pentest engagement
- Migration planner uses the subnet calculator to confirm the new /22 VLAN fits 950 devices
- Domain buyer verifies status flags and expiry via whois/RDAP before winning the auction
Frequently asked questions
Are the tools really free and signup-free?
Yes. Server tools have fair-use limits; browser tools run locally with no limit. No account and no cookies; visits are only counted by our own cookieless reach measurement. If you want to test XICTRAQ as a monitoring platform, there is a free plan with 24/7 monitoring — but that is optional.
Are my inputs and results stored?
Server tools process requests in memory and return them directly — we do not persist the checked domain or its result. Whois/RDAP caches for one hour to protect registries. Browser tools (JWT, JSON, encoder, UUID, subnet) never leave your machine — no network call.
Which location? Which hosting region?
All tools run on servers controlled by us in EU data centres (Falkenstein and Nuremberg). For multi-region checks (e.g. reachability from Helsinki, Falkenstein, Nuremberg in parallel) we offer multi-node monitoring in the dashboard.
What is the difference between server and browser tools?
Server tools (DNS, HTTP headers, SSL, mail, whois, pagespeed, reverse IP) must open outbound connections to remote hosts — that needs server-side execution. Browser tools (JWT, JSON, encoder, UUID, subnet) compute purely locally — safer for sensitive input.
Can I integrate the tools into my own scripts?
The public endpoints live at api.xictraq.com/api/tools/* and return JSON. They are not officially documented as an API — schemas may change. For stable API use we recommend the authenticated XICTRAQ plan that gives the same checks plus history, alerting and SLA.
What sets this collection apart from the usual single-purpose checkers?
Three points: (1) We are fully GDPR-compliant and EU-hosted — usable in public sector and regulated environments. (2) We bundle server and browser tools in one collection — no jumping between 5 different vendors. (3) Every check can be promoted to our 24/7 monitoring, with history, alerting and reports.
Related tools
Want continuous monitoring?
These tools give you a snapshot. XICTRAQ monitors uptime, SSL, security headers, GDPR, performance and SEO 24/7 — free plan, no credit card, EU-hosted, GDPR-compliant.