WHOISSSL & Security
Verify certificates, headers, and password strength.
What are SSL and security tools?
SSL and security tools check the protections a website shows to every visitor, plus two everyday password helpers. The SSL and security tools on this page inspect HTTPS certificates, the headers that tell browsers how to protect people, HSTS settings and insecure resources on secure pages. They are diagnostic checks that make normal requests only: none of them tries to break in or test logins.
The two password tools run entirely in your browser, so nothing you type is sent to us.
What each tool does
Certificates and HTTPS
SSL Checker connects on the HTTPS port and reports whether the certificate is trusted, valid for the hostname and in date, with its issuer, names covered, TLS version, cipher and chain.
SSL Expiry Checker shows the expiry date and days remaining, labelled healthy, warning at 30 days or fewer, critical at 7 days or fewer, or expired.
HSTS Checker shows whether HTTPS is in use and whether the Strict-Transport-Security header is sent, reading out max-age, includeSubDomains and preload.
Mixed Content Checker reads an HTTPS page's HTML and lists up to 20 insecure http:// resources, such as scripts, images and stylesheets.
Headers and overall security
Security Headers Checker reviews six protective headers and marks each as present, missing or set in a way that does not work.
Website Security Checker combines the certificate, HTTPS enforcement and the six security headers in one overview.
Passwords
Random Password Generator creates random passwords of 6 to 64 characters with your browser's cryptographic random generator, leaving out look-alike characters.
Password Strength Checker rates a password from Very Weak to Very Strong using length, character variety and an estimate of randomness.
Which SSL and security tools to use when
A browser shows a security warning
Run the SSL Checker on the exact hostname from the warning. It names the problem, such as an expired certificate, the wrong name or a missing intermediate certificate.
The padlock is missing on an HTTPS page
The Mixed Content Checker lists the insecure files that cause it, so you can switch each one to https://.
Preparing for a security review
Use the Website Security Checker for an overview, then the Security Headers Checker and HSTS Checker for the details behind each item.
Creating or reviewing passwords
Generate a new password with the Random Password Generator, or test an existing one with the Password Strength Checker. Store the result in a password manager rather than in a document or note.
How the certificate checks work
The SSL Checker and SSL Expiry Checker connect to port 443 with full certificate verification switched on, just as a browser does, and allow eight seconds for the connection. If verification fails, they still read the certificate, so they can explain why it was rejected. Hostnames that point to private or internal addresses are not checked.
Problems these tools help solve
- Visitors see "your connection is not private".
- A certificate renewal failed without anyone noticing.
- Old content still loads images over plain http.
- Security audits ask for headers the site does not send.
- Staff reuse short, guessable passwords.
- A subdomain is not covered by the site's certificate.
Related categories
Security connects with several other areas. Website Tools test status, redirects and speed, Email Tools protect your domain against email spoofing, and Domain Tools include an overall health score and risk signals for a domain.
Frequently asked questions
Is SSL the same as TLS?
TLS is the modern successor to SSL. Every original SSL version is outdated and disabled in browsers, and websites now use TLS 1.2 or 1.3. The name "SSL certificate" stuck, so the SSL Checker reports the TLS version actually negotiated along with the certificate details.
Are these security tools a penetration test?
No. They make the same ordinary requests a browser makes and report what any visitor can see: certificates, HTTPS enforcement, headers and insecure resources. They never scan ports, guess passwords or try to exploit anything, so they are safe to run on any public website.
Are my passwords sent to your server?
No. The Random Password Generator and the Password Strength Checker run entirely in your browser with JavaScript. Nothing you type or generate is sent to our server, stored or logged. It is still good practice not to type your most important passwords into any website.
What should I fix first on my website?
Start with the certificate and HTTPS, because an untrusted or expired certificate affects every visitor. Next, make sure HTTP redirects to HTTPS and add HSTS. Then add the low-risk security headers, and plan Content-Security-Policy last, testing it in report-only mode first.
Why does the SSL Expiry Checker say critical?
Critical means seven days or fewer remain before the certificate expires. Renew it now. If your host renews certificates automatically, something has probably gone wrong, such as a failed domain validation, so check the SSL section of your hosting panel instead of waiting.
Does the Mixed Content Checker find everything?
It finds insecure http:// addresses in the HTML that the server sends, which covers most cases. Resources added later by JavaScript are not visible to it. If browser warnings continue after you fix the listed items, the developer console names every blocked resource.
How long should a strong password be?
At least 12 characters for everyday accounts and 16 or more for important ones such as email and banking. Length adds the most strength. A password manager makes long, unique passwords practical, because it remembers and fills them in for you.