What this site is
ToolsForCyber is a collection of 18 free, self-contained tools — password and identity tools, network and DNS utilities, developer utilities like hash generators and decoders, and a CVSS calculator — built for people who need a quick, correct answer while they're on call, writing a report, or debugging something at 2am. It isn't run by a large vendor, and it doesn't try to be a comprehensive platform. It's a focused set of reference tools, each one built to get a specific, narrow question right.
How each tool is verified
Where an authoritative specification or primary source exists, the tool is checked against it directly — not a summary of one, and not a general impression of how something "usually" works. In practice, that means things like:
- The CVSS Calculator implements the equations from FIRST.org's own CVSS v3.1 Specification Document directly, including the exact floating-point-safe Roundup algorithm the specification itself prescribes, and is cross-checked against real, independently-documented CVE scores.
- The Port Lookup tool's dataset is built directly from IANA's own official Service Name and Transport Protocol Port Number Registry, not a secondary copy of it.
- The User-Agent Parser is explicit about where User-Agent strings are fundamentally ambiguous or spoofable — for example, that Windows 11 reports the same version token as Windows 10, confirmed against Microsoft's own documentation, rather than guessing and presenting a guess as fact.
- Every cryptographic or encoding tool (hashing, Base64, JWTs, UUIDs) is checked against the relevant standard and against independently-known test vectors, not just "does this look right."
When a topic turns out to be genuinely ambiguous or actively disputed — not just hard to look up — the tool says so, instead of picking an answer and presenting it with false confidence.
Local-only processing
Wherever a task can be done entirely in your browser, it is. Password strength checks, hash generation, JWT decoding, Base64 encoding, UUID generation, regex testing, CVSS scoring, and User-Agent parsing all run as JavaScript on your own device — nothing you type into those tools is ever sent anywhere. A small number of tools genuinely require a network request to do their job (DNS lookups, IP geolocation, and the breached-password check), and each of those is limited to exactly the request it needs: the password breach checker, for example, sends only the first five characters of a password's hash to HaveIBeenPwned's k-anonymity API, never the password itself.
Testing
Many of the tools on this site — including the CVSS Calculator, Port Lookup, User-Agent Parser, and every cryptographic or encoding tool — have their own automated test suite, run against known-correct expected values rather than just "did it crash": typically both a normative suite (testing the underlying calculation or parsing logic directly) and a browser-based UI suite (testing the actual page a visitor would use). Test suites are re-run as part of the validation process when a tool changes, and a fix isn't considered complete until its test suite passes consistently across repeated runs, not just once.
Frequently asked questions
What happens when a source or specification changes?
Standards and data sources do change — a port registry gets updated, a specification gets clarified, a browser vendor changes how it reports something. When that happens, the affected tool is re-checked against the current version of its source and updated if needed, rather than left to quietly drift out of date.
How do you handle mistakes?
If a tool gives a wrong or misleading answer, that's treated as a real bug: the root cause gets identified, a fix gets tested against the specific case that was wrong, and the fix stays in place only once it's confirmed not to break anything else the tool was already getting right.
Is ToolsForCyber affiliated with FIRST.org, IANA, or the other standards bodies you cite?
No. ToolsForCyber is an independent site that implements publicly published specifications and cites its sources directly so you can verify them yourself — it isn't endorsed by or affiliated with any standards body.
How is this site funded?
See the Affiliate Disclosure page for details on how the site is funded. Funding has no influence on how any tool calculates or reports a result.
Questions or something look wrong?
If a tool's output doesn't match what you'd expect, or a source has changed since a tool was last reviewed, we want to hear about it — get in touch via the Contact page.