Free tools & live data for people who run things on the internet
SysOSX is a small set of sharp, free tools for site owners, indie developers and small teams. Check a website's health in seconds, watch the dates that quietly take sites offline — certificate expiry, domain expiry — and work out what LLM APIs really cost before the invoice arrives. No sign-up, no clutter: one tool, one answer, one clear next step.
New & noteworthy
The newest additions to SysOSX, newest first — the latest checks, scanners and builders. The full collection lives on the tools index.
PowerShell Deobfuscator
Peel an obfuscated PowerShell script layer by layer in the browser — -EncodedCommand, gzip, char codes, concatenation, -f and backticks — as inert text that is never executed, with indicators listed as leads and 4104 fragments reassembled.
Deobfuscate a script → 🛡️SSH Server Config Auditor
Audit your sshd_config in the browser against the Mozilla OpenSSH guidelines and OpenSSH 10.6 defaults — per-line findings, Match-block scoping, and a hardened config to download. The file never leaves your device.
Audit a config → ✍️JWT Signer & Verifier
Sign a JWT with HMAC, RSA, ECDSA or EdDSA, verify one against a secret, PEM, JWK or a live JWKS, and build and validate key sets — all in your browser; keys never leave the page.
Sign or verify a token → 🧼IP Purity Check
Score any public IP from DNS blacklist listings, the Tor exit list, proxy/hosting/mobile flags and reverse DNS — every factor shown, unknown signals labelled, never verdicts.
Check an IP → ⚡Internet Speed Test
Measure download, upload, latency and jitter to the nearest Cloudflare edge, in your browser — with a CSV export and an honest account of what each number means.
Test your speed → 📦SBOM Vulnerability Scanner
Drop in a package-lock.json, requirements.txt, go.mod or CycloneDX/SPDX SBOM and check every pinned version against the OSV vulnerability database, with CISA KEV flags — parsed in your browser; the file is never uploaded.
Scan a lockfile → 🗝️SSH Key Suite
Generate Ed25519, ECDSA or RSA keys in OpenSSH format, audit authorized_keys and known_hosts files for weak or duplicate keys, and convert keys between OpenSSH, PEM and JWK — all in your browser; private keys never leave the page.
Manage SSH keys → 🔢TOTP Generator
Paste a Base32 2FA secret or a whole otpauth:// link and get the current two-factor code, the next code and a countdown — computed locally with WebCrypto; the secret is never sent or stored.
Generate 2FA codes → 👁️Browser Fingerprint Test
See what any website learns the moment you open it: your exits and IP geolocation, 100+ device, graphics and settings signals, canvas, WebGL and audio fingerprints, plus WebRTC and DNS leak and disguise-contradiction checks — read locally, nothing stored.
Test what sites see → 🔑Password Breach Check
Check whether a password appears in known data breaches — the SHA-1 is computed in your browser and only the first 5 hash characters are sent to Have I Been Pwned, so the password never leaves the page. Single check plus bulk mode (50 pasted passwords, or a file of 500 SHA-1 hashes).
Check a password →The tools
OpenAPI Diff
Diff two OpenAPI or Swagger specs in the browser: paths, parameters and schemas compared, every change classified breaking or non-breaking, with a JSON export.
Compare API specs → 🟢Provider Status Board
GitHub, Cloudflare, OpenAI, Anthropic, Stripe, Vercel, npm and Docker Hub status on one board — indicators, live incidents and scheduled maintenance.
Check provider status → 🗝️Leaked Secret Scanner
Probes a site for exposed .env and .git files and scans its page and JavaScript for leaked AWS, GitHub, Stripe and OpenAI keys — content-verified, shown masked.
Scan for leaked secrets → 🕵️Document Forensics
Inspect a PDF, PNG or JPEG locally: metadata and XMP, edit history, embedded files, hidden text and timestamp inconsistencies — every finding with its evidence.
Inspect a document → ✂️Secret Redactor
Paste text or drop a file and get a copy with API keys, tokens, passwords, private keys and card numbers replaced by [REDACTED] — 100% in the browser.
Redact secrets → 🧽Document Cleaner for RAG
Strip repeated headers, footers, page numbers and duplicate paragraphs from a PDF and export cleaned text plus JSONL chunks, ready for RAG.
Clean a document → 🪝Webhook Tester
A temporary receive URL that records every webhook delivery — method, headers, query and body — for 30 minutes of debugging.
Test a webhook → 🧾Third-Party Script & SRI Audit
Every script a page loads, classified first- or third-party, with version pinning assessed and sha384 SRI hashes computed for the third-party scripts missing them.
Audit page scripts → 🔐Security Headers Check
CSP, HSTS and four more response headers graded A+–F on a published 100-point table, with the value seen and copy-paste Nginx and Apache fixes.
Grade security headers → 🧹Broken Link Checker
One page’s links and images checked for dead ends — redirects, 404s, server errors and timeouts — with honest partial results and a CSV download.
Check a page’s links → 🖼️Open Graph Checker
See the share card Facebook, X, LinkedIn and Slack will build from any page: Open Graph and Twitter Card tags with their fallbacks resolved and labelled, the real share image measured, and a field-by-field checklist.
Preview share cards → 🎥HAR File Analyzer
Open a .har browser capture and read its requests, hosts, status codes and slowest calls — credentials masked by default, a redacted .har and a masked CSV to download. Never uploaded.
Analyse a HAR file → ♿PDF Accessibility Checker
Six structural accessibility checks on a PDF — tagged or not, language, title, heading structure, image alt coverage, bookmarks — each pass, fail or honestly undetermined. Never uploaded.
Check a PDF → 🗂️Bulk Domain & Certificate Checker
Paste up to 50 domains and get each one's registrar, registration and expiry dates plus its live TLS certificate in one sortable table, soonest expiry first — with a CSV export.
Check domains in bulk → 📊LLM Usage Cost Analyzer
Drop a CSV usage export or OpenAI usage API JSON and see what each model and each day actually cost — cached-token share, cost by model and by day, and the models no price table can price, listed instead of guessed. The file is parsed in your browser and never uploaded.
Analyse usage → 🔬Binary File Inspector
First look inside a PE, ELF or Mach-O binary: headers, sections, imports and strings — parsed locally, never uploaded, never run.
Inspect a binary → 🛰️BGP Lookup & RPKI Check
Look up who originates an IP or prefix, how widely the route is seen by RIPE RIS collectors, sample AS paths, and whether RPKI validates the origin — plus AS overviews with prefix counts and neighbours.
Check the route → 📡Global Ping
Ping, HTTP, DNS, traceroute and MTR from volunteer probes in networks around the world at once — the honest answer to "is it down, or is it just you?".
Test from everywhere → 🤖AI Agent Readiness Checker
Scan a domain the way an AI agent would — robots.txt and AI crawlers, llms.txt, bot challenges, raw-HTML content, OpenAPI and MCP discovery — and get a 0–100 readiness score with every finding and fix shown free, in fix-first order.
Check agent readiness → 🔏PGP Suite
Generate a key pair, encrypt and decrypt messages, create and verify cleartext signatures, and inspect any PGP key block — fingerprint, subkeys, expiry. Private keys and passphrases never leave your browser.
Use the PGP suite → 📱APK Analyzer
Open an Android APK without installing it: package and SDK levels, permissions with protection levels, exported components, debuggable and backup flags, and the signing certificates with their fingerprints. The file is parsed on your device and never uploaded.
Inspect an APK → 🪟EVTX Viewer
Open a Windows event log (.evtx) on any machine: summary, a filterable record table, structured EventData fields and raw XML for every event, with corrupt chunks reported by byte offset. Parsed locally by a WebAssembly engine; the file is never uploaded.
Open an event log → 🚫DNS Blacklist Checker
A domain's IPv4 addresses against ten IP blacklists and the domain against three domain lists — listed, not listed and error kept separate.
Check the lists → ✉️Email Deliverability Check
MX, SPF with a real lookup count, DMARC policy and DKIM selector probing — findings in plain language, in fix order.
Check email authentication → 📜Certificate Transparency Search
Every certificate the public CT logs hold for a domain, via crt.sh from the server — issuer, names and validity, newest first.
Search the logs → 🛡️CVE Triage
Paste up to 200 CVE ids — or a whole scanner report, ids are extracted for you — and rank them by known exploitation (CISA KEV), exploitation probability (FIRST EPSS) and CVSS severity, with KEV due dates, ransomware flags and a CSV export.
Triage the list → 🧩Certificate & Key Matcher
Drop in certificates, private keys and CSRs in any mix: matched by public key so you can prove which key belongs to which certificate, chained leaf to root with signature checks, converted between PEM and DER — plus a CSR generator. Keys never leave your browser.
Match a pair → 🕐Time Zone Meeting Planner
Pick a date and your cities: a 24-hour grid of local times coloured by work, shoulder and night, the true overlap or the best compromise, and a warning when a clock change is near.
Find a fair hour → 📈Capacity Estimator
From request rate, CPU time per request and a target utilisation: the cores you need, whole servers with N+1 or 2N redundancy, in-flight concurrency and a growth table to 10× traffic.
Estimate capacity → 🔐.env Parser & Validator
Drop in a .env file: entries parsed with values masked, duplicates and invalid keys flagged with line numbers, code references cross-checked, JSON and YAML export. Never uploaded.
Validate a .env → 🔤Base64 Encoder / Decoder
Text and files in Base64, Base64URL, Base32 and hex, live as you type. The decoder is strict: it names the exact position of the first invalid character instead of failing vaguely. Nothing is uploaded.
Encode or decode → #️⃣Hash Generator
MD5 (implemented from RFC 1321 — WebCrypto will not), SHA-1, SHA-256, SHA-384, SHA-512 and HMAC-SHA-256 for text or a dropped file. Real digests, computed locally; a chatbot asked for a hash will invent one.
Hash something → 🕵️Hash Identifier
What algorithm made this hash? Length, alphabet and prefix narrow it to a labelled shortlist — likely or possible, with the ambiguous families (MD5 vs NTLM above all) stated plainly. Identification only; nothing is cracked or uploaded.
Identify a hash → 🎫JWT Decoder & Verifier
Header and payload as readable JSON, iat/nbf/exp as a claim timeline, HS256/384/512 verification against your secret, and loud warnings for alg=none and asymmetric algorithms. Tokens are credentials: decoding happens in your browser only.
Decode a token → 🗝️Password & Token Generator
Passwords in bulk, passphrases from a 560-word list with the entropy shown, and hex or Base64URL API tokens — all from crypto.getRandomValues, never Math.random, never sent or stored. Plus a strength checker that charges for patterns, not just length.
Generate a secret → 📬DMARC Report Analyzer
Drop DMARC aggregate report files — .xml, .xml.gz or a .zip of them — and get per-source SPF and DKIM alignment, pass/fail totals and plain-language fix notes. Reports merge across receivers; files never leave your browser.
Analyse a report → 🕵️Email Header Analyzer
Paste raw headers or a whole .eml: the Received chain with per-hop delays, Authentication-Results verdicts, From/Reply-To/Return-Path mismatches, defanged body links and flagged attachments — each finding explained and weighted.
Analyse a message → 🎣PCAP Analyzer
Drop a .pcap or .pcapng capture: conversations sorted by bytes, every DNS query and answer, cleartext HTTP requests, TLS server names with JA3 fingerprints, cleartext-credential warnings and a defanged IOC export. The capture is parsed on your device and never uploaded.
Triage a capture → 🎓SSL Grader
A deep TLS audit: protocol matrix for TLS 1.0–1.3, key and signature detail, forward secrecy and HSTS — with a letter grade and the reasons behind it.
Grade a TLS setup → 🚪Port Scanner
Twenty well-known ports, one TCP connect each, from sysosx's server — open, closed and filtered reported separately, no banner reads, no custom ports.
Scan common ports → 🔗HTTP Status Chain Checker
Every redirect hop for one URL — statuses, targets, final URL and security headers — traced from sysosx's server.
Trace a chain → 🌍DNS Propagation Checker
One question, four answers: Google, Cloudflare, Quad9 and OpenDNS on where a domain points, with TTLs and a consensus verdict.
Check propagation → 🔀Subnet Calculator
Network, broadcast and usable range, wildcard mask and binary breakdown from one IP and prefix — plus a VLSM planner and IPv6 expand/compress. Pure arithmetic, in your browser.
Plan a subnet → 🌐DNS Lookup
A, AAAA, MX, TXT, CNAME, NS and SOA records for any domain via public DNS-over-HTTPS resolvers, with TTLs shown.
Look up records → 📋Log Parser & Redactor
Drop in an Apache, Nginx, JSON Lines or syslog file, filter by level and text, redact emails, IPs and tokens, and export clean CSV, JSON or text. Files never leave your browser.
Parse a log → 🎲Test Data Generator
Define fields, pick up to 10,000 rows, and download realistic fake data as CSV, JSON or SQL INSERTs — generated locally, never uploaded.
Generate test data → 📜SSL Certificate Parser
Paste a PEM certificate and read its issuer, subject, covered names, validity and fingerprint — plus an optional Certificate Transparency history lookup. For a live server check, use the SSL Checker.
Parse a certificate → 🔍Domain Lookup
Registrar, registration and expiry dates, nameservers and status flags straight from registry RDAP data.
Look up a domain → 📟On-Call Scheduler
List the team, pick a rotation length and start date, and get a fair round-robin on-call calendar for weeks ahead — printable, with a CSV download and a shift count per person.
Build a rotation → 🔑Self-Signed Certificate Generator
Common name, SANs, validity and key size in — PEM certificate and private key out, generated locally in your browser and never uploaded.
Generate a certificate → 🗄️Backup Retention Calculator
Grandfather-father-son retention simulated day by day: how many restore points you keep after 1 month, 6 months, 1 year and 2 years, and the storage they need.
Plan retention → ⏱️SLA Error Budget Calculator
Turn a 99.9% or 99.99% target into allowed downtime in minutes, then enter observed downtime or uptime to see the remaining budget and burn percentage.
Calculate a budget → 🩺Website Health Check
The full report: uptime and response time, TLS certificate, domain registration and DNS records on a single page, with a shareable URL.
Run the health check → 🔒SSL Checker
Certificate issuer, validity, days remaining, chain and hostname checks, and the negotiated TLS protocol.
Check a certificate → 📅Domain Expiry Checker
Registrar, registration and expiry dates with a live countdown, plus nameservers and key DNS records from registry data.
Check an expiry date → 🧮LLM API Cost Calculator
Compare monthly LLM API costs across models from your own request and token volumes.
Estimate a bill → 🏆LLM Pricing Leaderboard
A sortable table of every tracked model price, with sources and verification dates.
See the leaderboard →A check tells you about today. Monitoring tells you in time.
Certificates and domains expire on a schedule you do not control, and sites go down at the worst possible moment. The tools above are one-off snapshots; myeventwatch watches the same signals continuously and alerts you by email, Telegram, webhook and more — weeks before an expiry, minutes after an outage. Every report on SysOSX links straight to a free monitoring setup for the domain you just checked.
From the blog
Hands-on guides from twenty years of running systems — Windows Server and RDS, Linux, TLS, email and DNS — written by a former Microsoft engineer. Start with the ones readers actually search for:
- Resolving “No RDS License Servers Are Available” — the RDS licensing failure, traced and fixed step by step.
- TLS Grades, Earned and Lost — what actually moves a server between A+ and F.
- Why Your Email Lands in Spam — SPF, DKIM, DMARC and blacklist checks, in the order to run them.
- What Open Ports Say About a Server — reading a port scan like an operator, not a scanner.
- 10 Handy Linux Command Tricks — small shell habits that save time every week.
- Automating Ubuntu Server Setup with Ansible — the capstone of our Ubuntu Server series.
- Comprehensive Guide to Azure Storage Troubleshooting — the storage failure field guide the rest of the series hangs off.
- Troubleshooting with strace — watch what a process actually asks the kernel for, and find the real fault.
- What Is a Kernel Panic? — what the crash means, what to capture, and how to handle it without guessing.
- Resetting the RDS 120-Day Grace Period — the companion to the license-servers fix above.
Why these tools?
Most outages that hurt small sites are not exotic. They are a certificate nobody renewed, a domain that lapsed over a holiday, a DNS record edited once and never re-checked, or an API bill that doubled because a pricing page changed quietly. Each of those is cheap to detect and expensive to discover late. SysOSX exists to make the detection free and instant — and, where a one-off check is not enough, to hand you over to continuous monitoring that does the watching for you.
The LLM pages follow the same philosophy. Model prices change often, promotional rates expire, and headline numbers hide peak-hour multipliers and scheduled increases. Our calculator and leaderboard show the source and the verification date for every price, flag the ones we have not been able to confirm on an official page, and spell out the footnotes that change the bill. Live data, honestly labelled, beats a confident guess.