IA Internet Analysis
Log in
FREE SECURITY TOOLKIT

Collect focused evidence for security triage.

Use browser-based checks to inspect a request, decode a token, and review network or browser signals before you define the next diagnostic or audit step.

Browse security tools Professional security services
Test only systems you own or are authorized to assess.

Results are point-in-time observations. Do not enter secrets you cannot safely handle, and do not treat a passing browser check as proof that a system is secure.

AVAILABLE NOW

Web, API, browser, and network checks

Each tool answers a bounded question and explains its interpretation limits. Start with the evidence you need, then follow the linked guidance or service when broader assurance is required.

Web and API inspection

HTTP clientSend a browser request and inspect the status, response headers, and body that the target permits the browser to expose.Request runs from your browser; the target must permit cross-origin access.JWT decoderDecode token header and payload claims locally to review structure, timestamps, issuer, audience, and other visible fields.Token decoding stays in your browser; decoding does not verify trust by itself.

Exposure and privacy signals

Browser capability checkReview browser, platform, language, storage, display, and connectivity capabilities visible to a web application.Shows signals exposed by the current browser session.VPN and proxy signalsReview network and location signals that may indicate VPN or proxy use, with explicit limits on interpretation.A signal is not proof that a VPN is active or inactive.WebRTC connectivity checkInspect WebRTC and ICE connectivity information available to the browser for media and peer-to-peer connections.Results depend on browser privacy controls and network configuration.Public IP checkSee the public IP address and connection metadata presented to Internet Analysis by the current request.The result describes this connection and moment, not every device or route.DNS testMeasure name-resolution behavior and timing to identify basic DNS availability or performance issues.A browser test cannot enumerate every resolver or DNS security control.IPv6 connectivity checkVerify whether the current browser session can reach the internet over IPv6.Connectivity alone does not establish IPv6 firewall or host security.
NEED BROADER ASSURANCE?

Move from isolated signals to a scoped security assessment

A professional engagement can connect asset coverage, governance, technical controls, operating evidence, business risk, remediation ownership, and validation.

Explore security services View security audit
PRIMARY REFERENCES

Interpret results against recognized guidance

These sources help explain requirements and risk. A browser result alone does not demonstrate conformance with a framework or standard.

OWASP Application Security Verification StandardOpen requirements for verifying technical web application security controls.NIST Cybersecurity Framework 2.0A risk-based framework for governing, identifying, protecting, detecting, responding, and recovering.RFC 7519 — JSON Web TokenThe IETF standard defining the compact JWT claims representation.
QUESTIONS & LIMITS

Use the tools safely and interpret them narrowly

Can these tools perform a complete security audit?

No. They collect focused, point-in-time evidence from one browser session, request, token, or connection. A complete audit also needs an agreed asset scope, authorization, control evidence, ownership, risk analysis, and validation.

Can I test a website or API that I do not own?

Use active testing only on systems you own or are explicitly authorized to assess. These tools do not grant permission to probe, bypass controls, or access data. Respect the target’s terms, rate limits, and applicable law.

Does decoding a JWT verify that it is valid?

No. Base64url decoding reveals readable header and payload claims. Validity also depends on signature verification, trusted keys, expected issuer and audience, accepted algorithms, time claims, and application-specific authorization rules.

Why can the HTTP client fail when a URL works in a browser tab?

Browsers apply cross-origin resource sharing rules to scripted requests. A server may load normally as a top-level page while refusing to expose its response to a request from another origin.