Free Online Tools
Network, Privacy, Email & Developer Utilities 2026

Why Use Free Online Tools for Network and Privacy Analysis?

Every time you connect to the internet, your device shares data with hundreds of servers — your IP address, browser fingerprint, hardware specs, screen resolution, installed fonts, and even battery level. Most people have no idea how much information leaks from their browser. That is exactly why free online tools matter.

These 92 network tools and privacy tools let you see exactly what a server, a tracker, a mail receiver or a crawler sees. Instead of installing desktop software or browser extensions — which add their own tracking — every tool runs at the URL you visit. Enter a domain or an address, click once, and read the result. Whether you are chasing a DNS change that has not taken effect, working out why a mail provider is refusing your messages, checking whether a VPN is actually hiding you, or auditing a certificate before launch, the right tool is one click away.

The catalogue is organised into nine categories rather than one long list, because the questions people arrive with fall into distinct groups. The jump links at the top of this page go straight to each one.

Email Authentication: The Five Records That Decide Whether Your Mail Arrives

Email is where the ground moved most in the last two years. Gmail replaced deferrals with permanent rejections for non-compliant bulk mail in November 2025, Outlook applied its own hard refusal the same month, and in May 2026 the IETF published RFC 9989 and its companions, replacing the original DMARC specification from 2015. A domain that was merely untidy in 2024 can now have its mail refused outright.

Thirteen tools cover that ground. If you do not know where to start, start at the Email Health Check, which runs the whole set against one domain and returns them side by side. Then go to the individual tool for whatever it flagged.

SPF: the record that quietly runs out of lookups

SPF (RFC 7208) lists who may send for your domain. The trap is not syntax, it is the hard ceiling of ten DNS-querying mechanisms across the entire flattened include chain. Add one more mail vendor and you can cross it without touching your own record, because the count includes everything your includes include. Past the limit the evaluation returns a permanent error, and a receiver that treats permerror as a failure will reject mail that would otherwise have passed. The SPF Checker resolves the chain and counts the lookups rather than guessing; the SPF Generator builds a record that stays under the limit in the first place.

DKIM: you need the selector before you can check anything

A DKIM key (RFC 6376) is published at <selector>._domainkey.<domain>, and DNS gives you no way to list selectors — you have to know the name. That is why a DKIM check starts with a signed message: the selector is in the DKIM-Signature header. The DKIM Checker takes a selector and domain, fetches the published key, and reports the key type and size as well as whether the record parses.

DMARC: the record that ties the other two to the visible From address

SPF and DKIM both authenticate a domain, but not necessarily the domain a reader sees. DMARC closes that gap by requiring alignment: at least one of SPF or DKIM must pass and match the From header domain. The DMARC Checker validates a published record against RFC 9989, including the np tag that sets policy for subdomains that do not exist at all — the gap forgers used to walk through. The DMARC Generator writes a record from the policy you actually want, with the reporting addresses in the right format.

MTA-STS and BIMI: transport and identity

MTA-STS (RFC 8461) tells sending servers to require TLS to your domain, and it has three moving parts that have to agree: a TXT record at _mta-sts carrying a policy id, a policy file served at https://mta-sts.<domain>/.well-known/mta-sts.txt, and a valid certificate on that hostname. Change the policy without changing the id and senders keep using the cached old one. The MTA-STS Checker reads all three and reports which one disagrees.

BIMI puts your logo beside your messages, and it is gated: the domain needs DMARC at quarantine or reject with enforcement before anything else matters, the logo has to be SVG Tiny Portable/Secure rather than an ordinary SVG, and several mailbox providers additionally require a Verified Mark Certificate. The BIMI Checker checks the record, the logo file against the profile, and the certificate reference.

When the problem is reputation rather than records

Perfect authentication does not help an address that has already earned a bad name. Check the sending address with the Sender IP Reputation tool and against the major DNSBLs with the IP Blacklist Check. If a specific message was rejected, paste its headers into the Email Header Analyzer, which reconstructs the delivery path, marks which hops can be trusted, and works out alignment itself rather than reprinting the receiving server’s verdict. Before you send at all, the Email Verifier checks an address is deliverable and the Temp Email Checker keeps disposable domains out of a signup form.

For the background on all of this, read how to check if your IP is failing SPF, DKIM and DMARC, what an IP reputation score is, IP reputation for bulk email, and the 550 RBL blocked sender fix guide.

IP Address Converters: One Number, Written Several Ways

An IPv4 address is a 32-bit number, and a dotted quad is only one way of writing it down. Fourteen tools move between the representations, in both directions, because in practice you meet all of them.

Binary is the form subnet masks actually operate on, so IP to Binary and Binary to IP are the pair to reach for when a mask is not selecting what you expected. Decimal is the form a database should store, because integers sort and range-query correctly where strings do not — IP to Decimal converts both ways. Hex and octal mostly turn up in things trying not to be read: IP to Hex decodes the obfuscated links that appear in phishing mail, and IP to Octal covers the leading-zero case that has caused real parser bugs, because some libraries read 010 as octal 8 and others as decimal 10, and a filter that disagrees with the connecting library is a filter that can be walked past.

On the IPv6 side, IPv6 Expansion writes an address out in full and IPv6 Compressor shortens it by the RFC 5952 rules — which matter because two spellings of the same address will not match as strings, and that is why an allowlist entry sometimes silently fails. IPv6 to Binary shows all 128 bits grouped the way the address is written. IPv4 to IPv6 and IPv6 to IPv4 handle the embedded forms — the ::ffff: mapped notation that dual-stack servers write into logs for what was really an IPv4 connection, plus the compatible and 6to4 forms.

Three utilities for working with addresses in bulk: IP Extractor pulls every address out of a block of pasted text such as a log excerpt or an email header, IP Sorter puts a list into true numeric order rather than the alphabetical order a text editor gives you, and Random IP Generator produces test addresses. The Phone Number to IP Address Converter runs the same arithmetic on a phone number, which is a format novelty used for puzzles — not a lookup. No tool can find somebody’s real IP from their number, and that page says so on its face. New to the notation? Read how to read and understand IP address format and what an IPv6 address is.

Privacy and Leak Testing: Know What Trackers Already See

Modern tracking goes far beyond cookies. A site can identify your device from a combination of GPU rendering, audio processing, installed fonts, screen geometry and dozens of other details — a browser fingerprint that survives clearing cookies and switching to a private window. Twelve tools here split into two jobs: finding leaks, and measuring the fingerprint.

Leaks: things your software hands over without being asked

Start with Browser Leaks for the overview. Then WebRTC Leak Test, because WebRTC can reveal your real address even behind a VPN — it is the single most common way a VPN user is unmasked, and it happens in the browser rather than in the tunnel, which is why the VPN itself reports no problem. The Torrent IP Leak Test covers the case a browser test cannot reach at all: your torrent client announces itself to trackers and peers separately from your browser, so it can be leaking your real address while every browser-based test comes back clean. The test shows you the address a swarm actually receives. The Referrer Leak Test shows what your browser tells the next site about where you came from. For a fuller treatment, read how to check if your IP is leaking through a VPN and the WebRTC leak test and fix guide.

Fingerprint: the signals that identify you without any leak at all

Canvas Fingerprint shows how your GPU renders text differently from every other device. Audio Fingerprint reveals your audio processing signature. JA3 TLS Fingerprint works one layer lower, identifying your client from the shape of its TLS handshake — before any JavaScript has run. Font Leak Tester shows which installed fonts a site can enumerate. Battery Checker checks whether the Battery API is exposing a value precise enough to be used as a short-lived identifier.

Two tools look for contradictions rather than values. Fingerprint Consistency checks whether your signals agree with one another — a mismatch between what your user-agent claims and what your rendering stack does is itself a strong identifier, which is why some anti-fingerprinting setups make you more distinctive. Timezone Audit is the sharpest version of that test: a browser clock in one country and an IP address in another is one of the easiest VPN tells there is. Finally, EXIF Data Remover strips the location and device metadata cameras write into photo files before you share them. Background reading: AI browser fingerprinting and how to clear your IP history and digital footprint.

Which Tool Do You Need? Start From the Symptom

Most people arrive here with a problem rather than a tool name. Find the line that matches what is actually happening and start there.