Free Developer Tools
Useful developer tools, free to use without an account. Inputs are processed transiently on our UK infrastructure and aren't stored.
Website assets
Website testing
Images
Finance and e-invoicing
XML invoice viewer
Open a UBL or Peppol invoice or credit note as a readable document, then download it as a PDF.
Peppol invoice validator
Check a UBL invoice or credit note against EN 16931 and Peppol BIS Billing 3 rules, no account needed.
UBL to PDF converter
Turn a UBL or Peppol invoice XML into a readable, paginated PDF, keeping the original XML.
XRechnung validator
Check an XRechnung invoice or credit note in UBL or CII against the official XRechnung 3.0.2 rules.
XRechnung viewer
Open an XRechnung in UBL or CII and read it as a document, with every value traced to its XML line.
ZUGFeRD / Factur-X validator
Check a ZUGFeRD or Factur-X PDF or XML: the PDF/A, the embedded invoice and its metadata, and the ZUGFeRD 2.5.2 profile rules.
Security tools
Check the public security configuration of a website or domain: email authentication, DNS, TLS, HTTP headers and what a site discloses. These are the checks Ironfang Security runs, made from its scanner address, and nothing you enter is kept.
Website security
Email security
DMARC checker
Look up a domain's DMARC record, read its policy and reporting, and see what to change.
SPF checker
Check a domain's SPF record, its all mechanism and how many of the 10 DNS lookups it uses.
DKIM checker
Look up a DKIM key at your selector or at common ones, with its key type and size.
Email security checker
Check MX, SPF, DMARC and DKIM together, and the protection of a domain that sends no mail.
DNS security
DNS security checker
Check a domain's address records, nameserver redundancy, CAA, DNSSEC and dangling CNAMEs.
DNS checker
Look up a domain's A, AAAA, CNAME, MX, TXT, NS, SOA, CAA and DS records through public resolvers.
DNSSEC checker
See whether a domain's zone is signed, with a DS record at its parent.
CAA checker
See which certificate authorities a domain allows to issue its certificates.
Dangling DNS checker
Find a CNAME that points at a name that no longer exists.
TLS and certificates
SSL/TLS checker
Check a site's HTTPS, certificate, expiry, TLS versions and weak cipher suites.
Certificate checker
Read a site's TLS certificate: the names it covers, its issuer, validity and trust.
Certificate expiry checker
See when a site's TLS certificate expires and how many days are left.
TLS version checker
See whether a server still accepts SSL 3.0, TLS 1.0 or TLS 1.1, and whether it offers TLS 1.3.
TLS cipher checker
See whether a server accepts broken or weak cipher suites such as RC4, 3DES or export ciphers.
HTTP security
HTTP security headers checker
Check a site's HSTS, CSP, framing, content-type, referrer and permissions headers.
HSTS checker
Check Strict-Transport-Security: max-age, includeSubDomains, preload and the HTTP redirect.
Content Security Policy checker
Read a site's Content-Security-Policy directive by directive and spot unsafe inline scripts.
Clickjacking protection checker
See whether other sites can frame a page: CSP frame-ancestors and X-Frame-Options.
Cookie security checker
Check the Secure, HttpOnly and SameSite attributes of the cookies a home page sets.
security.txt checker
Check a site's /.well-known/security.txt: its contact, its expiry and its format.
Exposure and discovery
Exposed services checker
Check your domain for databases, remote desktop and other services open to the internet, once it is verified.
Technology detector
See the web server, CDN and frameworks a site's home page discloses.
End-of-life software checker
See whether a site advertises software versions that no longer receive security fixes.
Subdomain finder
Find a domain's subdomains in public certificate transparency logs.
Built and operated by Ironfang in the UK. Inputs are processed transiently and never stored; see the privacy policy.