Most security problems that get exploited are not exotic. They are an exposed .env file, a missing HSTS header, a session cookie without Secure, a reused password from a breach list or a "complex" password that follows the same pattern as everyone else's. Finding them early is cheap; the tools in this category are built for that, and built to stay on the right side of responsible testing.
Web Pentest & Security Assessment checks websites you are authorized to test. The Password Generator creates strong random passwords, and the Password Checker shows how an attacker would rate a password and whether it appears in breach data.
What these tools cover
- Website exposure: technologies and visible versions, HTTP security headers, cookie flags, CORS, TLS certificate and redirect, public well-known files and, after DNS TXT ownership verification, a curated list of sensitive, default, admin, API and CMS paths. Findings come with evidence, severity, a fix and a transparent exposure score.
- Password creation: cryptographically secure random passwords in the browser with configurable length, character types and exclusions, with entropy in bits.
- Password evaluation: pattern-based strength estimation (zxcvbn-ts) with cracking times for four attack scenarios and an opt-in k-anonymity breach check.
What the category deliberately does not do: exploitation, login attempts, password guessing, denial-of-service, or testing of systems without authorization.
Why they matter
- Automated attackers check the same things. Scanners look for
.git,.env, backups and admin pages on every public site; owners should find them first. - Configuration drift is common. CDN changes, migrations and updates silently drop headers or redirects; regular checks catch that.
- Passwords remain a primary entry point. Breached and predictable passwords are tried first; random, unique passwords and breach screening remove the easiest wins.
- Safety by design. Rate limits, ownership verification and local-only password handling mean the tools do not create new risks while measuring old ones.
The tools at a glance
| Tool | What it does | Best for | Guide |
|---|---|---|---|
| Web Pentest & Security Assessment | Safe exposure assessment: technologies, headers, TLS, exposed files. | Assess a website you are authorized to test: detected technologies and versions, security headers, cookies, CORS, TLS, exposed and default files, admin and API endpoints — with a risk score, visual dashboard and recommendations. | Guide |
| Password Generator | Generate strong random passwords with the characters you choose. | Generate strong random passwords in your browser: choose length and character types, exclude look-alikes, and see each password’s strength in bits. | Guide |
| Password Checker | See how strong or weak a password really is. | Check how strong a password is: common-password and pattern detection, estimated cracking time and tips — analyzed in your browser, never sent anywhere. | Guide |
Which tool should I use?
| Problem | Tool | Guide |
|---|---|---|
| "Does my website leak files, versions or weak headers?" | Web Pentest & Security Assessment | Website security assessment guide |
| "Are my security headers, cookies and HTTPS redirect configured?" | Web Pentest & Security Assessment – Quick profile | Website security assessment guide |
| "I need a strong password for an account, device or Wi-Fi" | Password Generator | Password Generator guide |
| "How strong is this password really? Has it been breached?" | Password Checker | Password Strength Checker guide |
| "Is my certificate chain complete and when does it expire?" | SSL Checker | SSL Certificate Checker guide |
| "Which ports are open on my server?" | Port Scanner & Firewall Test | Port Scanner guide |
Typical workflows
Hardening a newly launched website
- Run the Quick profile in Web Pentest & Security Assessment and fix missing headers, cookie flags and HTTP-to-HTTPS redirect.
- Verify ownership with the DNS TXT record and run Standard to check for exposed files, default installs and admin pages.
- Check the certificate chain in the SSL Checker and open ports in the Port Scanner (same verification token).
- Publish a vulnerability contact and validate it with the security.txt Checker.
- Re-run the assessment after each fix and export the report for the change record.
Replacing a weak or breached password
- Test the current password style in the Password Checker and press Check breaches.
- If it is weak or found, generate a replacement with the Password Generator (16+ characters, 20+ for offline-attackable secrets).
- Paste it straight into a password manager and the target system, then clear the clipboard.
Reviewing a password policy
- Collect examples of passwords users would create under the policy (not real ones).
- Check them in the Password Checker to see patterns and cracking times.
- Compare with generated passwords from the Password Generator and adjust the policy toward length and breach screening rather than composition rules.
Related guides
- Website security assessment – what is tested, how verification works, how the score is built.
- Password Generator – entropy, character sets and settings.
- Password Strength Checker – zxcvbn, cracking times and k-anonymity.
- SSL Certificate Checker, Port Scanner & Firewall Test and security.txt Checker.
- Network Diagnostics and My Info & Identity tools.
Frequently asked questions
Can I scan any website with the security assessment?
Only websites you own or are explicitly authorized to test. Quick checks of headers, TLS, technologies and well-known files require you to confirm that authorization, and wordlist checks of sensitive paths additionally require DNS TXT ownership verification.
Do any of these tools exploit vulnerabilities or try passwords?
No. The assessment sends only GET requests at a limited rate and never logs in, guesses credentials, submits forms or sends modifying requests. The password tools never attack anything; they run in your browser.
Are my passwords sent to NetTools?
No. The generator and checker run entirely in your browser. The checker's optional breach check sends only the first five characters of the password's SHA-1 hash from your browser to Have I Been Pwned.
Is the website assessment a replacement for a penetration test?
No. It is an automated exposure assessment of publicly visible weaknesses. A penetration test is a manual engagement under contract that goes far deeper and actively tests exploitability.
Which tool should I use first for a new website?
Run the Quick profile of the security assessment, fix headers and TLS, then verify ownership and run the Standard profile to find exposed files. Check certificates in detail with the SSL Checker and open ports with the Port Scanner.
Are more security tools planned?
The category may grow over time, but only the tools listed here are available today. Planned tools are labelled as such in the tool directory.