Security

Open-source, privacy-first authenticator and password manager. No account required, tokens stay on your device, and backups are under your control. A solid alternative to the big-name 2FA apps that want your phone number and a cloud account.

A cross-platform password manager with open source clients, secure vault sharing, passkeys, and self-hosting options.

Encrypted video calls right in the browser — no app install required. Free for up to four people, with optional premium tiers for larger meetings. A handy option when you want a quick private call without handing everyone a Zoom account.

Maintenance check for your mail server

Steve Gibson's long-running internet vulnerability profiler. Probes your public IP from the outside to show open ports, firewall behavior, and what attackers can actually see — no install, no account, and still one of the fastest ways to sanity-check a router or home network.

End-to-end encrypted messaging, voice, and video calls without ads, trackers, or a parent company mining your conversations. Run by a nonprofit and funded by donations rather than your data. The default recommendation when someone asks how to talk privately.

Steve Gibson's legendary hard-drive maintenance and data recovery utility from GRC. Boots from its own media and works down at the magnetic surface to test, refresh, and often recover sectors that the OS has given up on — the kind of tool you hope you never need until you really, really do.

Quickly spot-check any USB mass storage drive for fraudulent deliberately missing storage. Fraudulent USB/SD storage being sold through trusted marketplaces has exploded and using/trusting a bad drive can have immediate horrible consequences. Use this utility to CYA!

A utility to decode and deserialize a JWT token to inspect the data inside

Inspired by countless conversations over my career about what information every website you visit actually knows about you, here is a brief example of information my web server knows about you and your connection with just a few lines of code. This is just the tip of the iceberg compared to what trackers (website plugins which follow you from one website to another running analytics on your browser behavior) know about you.

Inspect PEM, CER, CRT, DER, and PFX/P12 certificates locally. View subject, issuer, validity, fingerprints, SANs, key usage, and full certificate chains.