# Tool pages
Each Tamperbox tool page opens on a live result or controlled example, shows its verdict and evidence, and links here for the method behind every finding.
Canonical: https://docs.tamperbox.dev/tools/
Updated: 2026-10-26
Applies to: tamperbox.dev, October 2026
Outputs: The documentation page for a Tamperbox tool, with its method, finding reference and guide
Limitations: Only the tools listed here have a documentation page; the other tool pages carry their full reference on the page itself.
Browse the same groups as the [tool directory](https://tamperbox.dev/). Each card starts with a reason to use the tool, followed by what its documentation covers.
A tool page on [tamperbox.dev](https://tamperbox.dev) has one job: take one input, show the verdict, and show the evidence behind it. The page keeps a short "How it works", the limits that change how you read a result, three questions people ask, and the standards it follows. Everything longer lives here.
Each tool's documentation has the same shape, so a finding on the page always has a place to point to:
| Section | What it holds | Where the page links to it |
| --- | --- | --- |
| Method | Every rule the tool applies, in the order it applies them, with the exact wording of each finding | "Read the method" on the What does it mean and Tool limitations cards |
| Finding reference | One row per finding: severity, what it means for whoever receives the output, the fix | The finding itself |
| Guide | Step by step, for each situation the tool can put you in, including how to verify the fix | "Step by step on docs" on the How to fix it card |
| Worked example | The live default or an explicitly loaded controlled sample, read end to end, and what each Break it case shows | "Worked examples on docs" |
| For agents | How to run the same check through the MCP server and what the result does not prove | The For agents band on the page |
## APIs & HTTP
JWT Decoder & VerifierDebug a rejected login token without sharing it with another service.A token's header and claims decoded in the browser, its signature verified with your key, and test tokens rebuilt from edited claims.
Postman Collection ConverterMoving away from Postman? Take your requests with you.Postman, OpenAPI and cURL converted in the browser, with a report of what was kept, dropped and redacted.
Redirect CheckerA link lands somewhere unexpected? Follow the detour.Every hop of a redirect chain with what changed on each, and the loops, downgrades and temporary codes to fix.
HTTP/3 & Compression CheckerIs your site missing out on faster page delivery?The HTTP/3 offer and a QUIC connection, what each Accept-Encoding gets back, and HSTS against the preload list's rules.
CORS TesterThe request works outside the browser. Find out why the browser might refuse it.The browser's CORS algorithm step by step, from the preflight to the real response, with the headers that would allow the request.
HAR File SanitizerNeed to share a browser trace for a bug report? Review and redact it first.Secrets and personal values replaced with stable placeholders, and the failed requests listed for a ticket.
HAR to MocksTurn captured responses into test fixtures.Export MSW or WireMock fixtures, create Playwright setup, or compare captures.
Negative Payload GeneratorGenerate invalid request bodies from schemas.Create verified-invalid cases for a supported JSON Schema or OpenAPI subset.
Cookie Header ExplainerExplain cookie scope and cache reuse rules.Inspect Set-Cookie, Cache-Control, Vary and ETag without sending requests.
## Web security & TLS
DANE & TLSA CheckerChanged a server certificate? Check that its DNS fingerprint still matches.The TLSA records of every mail server, whether DNSSEC protects them, and which one matches the certificate the server presents.
Security Headers CheckerFind browser protections your website may be missing.The six headers a response sends to protect visitors, the rule behind each point of the grade, and the lines to send instead.
SSL Certificate CheckerA certificate warning or renewal coming up? Check what your server presents.The certificate a server really sends, its chain on one time axis, the names it covers, the connection it negotiated.
Post-Quantum TLS CheckerSee whether your site can negotiate a post-quantum key exchange.Two handshakes on port 443: the key exchange group a server chooses, and whether it takes ML-KEM when nothing else is offered.
security.txt CheckerHelp someone who finds a security issue reach the right contact.A site's security.txt read the way a researcher reads it, checked against RFC 9116, with a corrected file to publish.
Mixed Content & Cookie CheckerMoved to HTTPS? Look for insecure resources and cookie settings left behind.Every http:// address on an HTTPS page sorted by what browsers do with it, and every cookie judged against the rules browsers enforce.
## Email & DNS
MX Lookup & Email Domain CheckerCheck where a domain receives mail before changing its setup.How Tamperbox validates a mail domain, reads MX and address fallback records, identifies null MX, and explains what public routing evidence proves.
Email Provider LookupTaking over a domain? Find out who handles its email.How Tamperbox attributes public MX hostnames to mailbox services and gateways, handles mixed routes, and preserves uncertainty about the downstream mailbox host.
SPF CheckerAdded another email service? Check whether your sender rules still fit.Every DNS lookup an SPF record costs, the include tree behind it, and a flattening plan that replaces only what it must.
DMARC Checker & GeneratorWork out how your domain asks receivers to handle mail that fails authentication.The policy graded tag by tag, and the next record on the path from p=none to reject, with every change kept in History.
DKIM Record CheckerCheck the public signing key your email provider asked you to publish.Every DKIM key a domain publishes, measured from the key bytes, with the selector found for you.
MTA-STS & TLS-RPT CheckerCheck whether your domain tells senders to use encrypted mail delivery.The chain a sending server follows: the record, the policy file, MX coverage and TLS reports, with a policy that covers every server.
BIMI Record CheckerTrying to get your logo into inboxes? Check the published requirements.The record, the SVG logo, the mark certificate and the DMARC policy behind a logo in the inbox.
Email Header AnalyzerA message arrived late or failed authentication. Follow its trail.A message's route hop by hop, the receiver's authentication results, and the identities compared, all in the browser.
## Domains, registration & hosting
SaaS Stack DetectorSee which services leave clues in a domain's public DNS records.How Tamperbox reads public TXT records for service-verification tokens and SPF senders without claiming that an account is active.
Website Hosting CheckerTaking over a website? Find the networks serving it.How Tamperbox follows website DNS, maps public addresses to networks, and compares the apex with www.
CDN DetectorFind out whether a CDN or proxy sits in front of a website.How Tamperbox combines DNS, network and HTTPS response clues to identify a likely content delivery network.
DNS Provider LookupNeed to change DNS? Find out which provider runs it.How Tamperbox groups authoritative nameservers, recognises providers, and flags fragile or mixed delegation.
Website Technology DetectorCurious what a website is built with? Look for clues in its pages.How Tamperbox identifies web technologies from bounded HTML and response-header signatures without executing the page.
Subdomain FinderFind forgotten or unexpected hostnames in public certificate records.How Tamperbox extracts DNS names from public Certificate Transparency observations and labels risky-looking names.
Domain Availability CheckerGot a name for your next project? Check whether the domain is available.Registration evidence, dates and status codes without a guarantee of availability.
WHOIS & RDAP LookupFind where a domain is registered and when its registration expires.Domain and network registry records, contacts and raw RDAP evidence.
Domain Health CheckTaking over a domain? Get a starting list of things to check and fix.How Tamperbox combines DNS, mail, TLS, HTTP and security-header observations into one bounded health report.
## DNS
DNS LookupCheck where a domain points before blaming the app.Any record type from a public resolver or the zone itself, with status, flags and the DNSSEC answer bit.
DNS Propagation CheckerChanged DNS, but some people still see the old site? Compare the answers.Twelve public resolvers against the zone’s own answer, with the cache time left on every old answer.
TXT Record LookupA service won't verify your domain? Check the records it can see.Every TXT record on a name, named by what it is for, with its strings measured against the 255-character limit.
CNAME LookupMoved or deleted a hosted service? Look for aliases left pointing at it.The alias chain from a name to its address, with dangling targets, apex aliases and loops caught.
NS LookupChanging DNS providers? Check which nameservers your domain delegates to.The nameservers a zone delegates to, the provider behind each, and the unfinished migration.
SOA LookupInvestigate DNS updates and cache timing at the zone level.A zone’s SOA field by field, the serial read as a date, and the four timers checked.
AAAA LookupCheck where IPv6 visitors are being sent.A name’s IPv6 addresses, sorted by kind, with the network behind each and the IPv4 question answered.
SRV LookupFind the servers an app is told to use, and which it should try first.The servers a service names, in priority order, with each one’s share of connections.
CAA LookupTrouble issuing a certificate? Check which issuers your domain allows.Which certificate authorities may issue for a name, inherited from parents, against the certificates already logged.
DNSSEC CheckerDNS stopped resolving after a change? Check for broken signatures or delegation.Resolver validation and the diagnostic chain of DS, keys and signature windows.
Reverse DNS LookupFind the name attached to an IP address and whether the two agree.PTR names and forward confirmation for a domain or IP addresses.
## Network & IP
## Data formats
## Web & URLs
Website Down CheckerCan't open a site? See whether our server can reach it.One request from our server: up, slow, erroring or down, and the stage where a request stopped.
Broken Link CheckerCatch dead links and missing page resources before your visitors do.Every link, image and script on one page requested from our server: broken, unclear, redirected or working, with where each one sits.
Open Graph PreviewMake sure a shared link shows the title and image you intended.The card every platform draws for a link, from its Open Graph, X and HTML tags, with the tags to add.
Robots.txt & Sitemap CheckerCheck whether your crawler rules block pages you want discovered.Which search and AI crawlers the rules let in, the line that decides any URL, and the sitemaps they announce.
Ads.txt & App-Ads.txt CheckerCheck the published list of who is allowed to sell your ad space.Every ads.txt line buyers would skip, and each seller checked against its ad system's sellers.json.
llms.txt Checker & GeneratorGive AI tools a starting guide to your site's useful pages.The outline an AI agent reads from a site's llms.txt, every format problem, and a draft made from the site itself.
## Text & test data
## Localization
## UI testing
## Where processing happens
Every tool page says, next to its verdict, where your input goes. The rule is the same across tools:
- **Pasted evidence is parsed locally when the tool supports that mode.** A pasted domain still starts a live lookup. Website Hosting Checker also looks up network information for pasted public IP addresses. Read the tool’s processing notice before running it.
- **A host name or domain means a named server-side check.** The server makes the required connection, DNS queries or published-file fetches, returns what it saw, and keeps nothing. The page names the port and the records or files it checks before it runs them.
Ordinary rail links carry no input. Explicit result actions temporarily use browser session storage and a random transfer token in the URL fragment. The transferred input itself is not placed in the URL. See each guide for its input handling and network requests.
## Break it, Heal it, History
Tool pages offer Break it examples and applicable Heal it repairs. Pages with History also expose Revert and Reset input:
- **Break it** loads a deliberate edge case built from your own input where that is possible, so you see what the finding looks like before it happens to you.
- **Heal it** offers the repairs the tool found, each saying what it will change. After a break with no repair, it offers to restore the input you had before.
- **History**, under the result, logs every change with what it replaced. Revert undoes the newest change; Reset input returns to what you entered.