Free online tools that run in your browser
Your files never leave your device · No login required · 100% free
Convert, compress, calculate, generate, edit and check files right in your browser — fast, private and easy to use.
Search results
Popular tools
View all toolsBrowse by category
Popular file conversions
View all convertersProgramming
Learn and practise programming in your browser. Pick a language: write code, run it in a real terminal and follow the lessons step by step.
Why Shiklo Tools?
Simple, private tools that just work — right in your browser.
- Private Everything runs in your browser. Files are never uploaded.
- Secure Encrypted HTTPS connection, and nothing you open is stored on our servers.
- No login required No account, no sign-up, no email. Just open a tool and use it.
- Fast No upload or download wait — results appear instantly.
- Free All tools are free to use, with no limits.
- Works everywhere Phone, tablet or computer, in any modern browser.
🆕 New tools
★ Popular tools
Recently used
Frequently asked questions
Are my files or text uploaded anywhere?
No. Every tool runs inside your browser on your own device. Nothing you enter or open is sent to a server.
Do I need to create an account or log in?
No login is required. There are no accounts — open any tool and start using it straight away.
Are the tools really free?
Yes. All tools are free, with no limits or watermarks. The site is supported by ads.
Does it work on my phone?
Yes. The tools work in any modern browser on phones, tablets and computers.
Can I use the tools offline?
Once a tool has loaded it does its work on your device, so it keeps working even if your connection drops.
Which file types are supported?
PDF, Word, Excel, PowerPoint, OpenDocument and RTF documents, JPG, PNG, WebP, HEIC, AVIF, GIF and BMP images, MP4, MOV, WebM and MKV videos, MP3, WAV, M4A, OGG and FLAC audio, ZIP, 7z, RAR, TAR and GZIP archives, CSV, JSON, XML and plain text. Each tool lists exactly what it opens.
All tools with descriptions →
Security Headers Checker
Check a website's HTTP security headers — HSTS, CSP, X-Frame-Options, Referrer-Policy and more — get a grade and how to fix each gap.
HTTP security headers are instructions a website sends to the browser: always use HTTPS, only run scripts from these places, don't let other sites frame this page, don't guess file types, don't leak full addresses to other sites, and keep the camera and microphone off. They cost nothing to add and block whole classes of attacks, yet many sites miss several of them.
Enter a website address and this checker fetches its response headers, follows any redirects, and grades the site from A+ to F. Each check says what was found and, where something is missing or weak, the exact header to add. It also points out cookies without the Secure, HttpOnly or SameSite flags and headers that reveal software versions. Only the headers are read — never the page content — and the address you check is not stored.
How to use Security Headers Checker
- Enter the website address, such as example.com.
- Press Check headers.
- Read the grade and each finding.
- Add the suggested headers in your server or CDN, then check again.
Features
- Strict-Transport-Security, including max-age.
- Content-Security-Policy strength.
- Clickjacking protection (X-Frame-Options or frame-ancestors).
- X-Content-Type-Options, Referrer-Policy, Permissions-Policy, Cross-Origin-Opener-Policy.
- Cookie flags and version leaks.
- Grade from A+ to F with fixes for each gap.
- All response headers shown.
What is checked and how it is scored
The grade is based on points for each header. Sites that don't end up on HTTPS always score F, because the other protections can be stripped in transit.
| Header | Points | Good value |
|---|---|---|
| Strict-Transport-Security | 25 | max-age of at least 180 days |
| Content-Security-Policy | 25 | A policy that restricts scripts |
| X-Frame-Options or frame-ancestors | 15 | DENY / SAMEORIGIN or 'none' / 'self' |
| X-Content-Type-Options | 10 | nosniff |
| Referrer-Policy | 10 | strict-origin-when-cross-origin or stricter |
| Permissions-Policy | 10 | Present |
| Cross-Origin-Opener-Policy | 5 | same-origin |
Reading the results
Green findings are fine. Amber findings work but could be stronger — for example a short HSTS max-age, or a CSP that still allows inline scripts. Red findings are missing protections that are easy to add. Grey notes are informational: software versions in Server or X-Powered-By headers help attackers find known vulnerabilities, and cookies without Secure, HttpOnly and SameSite can be stolen or sent in cross-site requests.
Adding the headers
Headers are set where your site is served: in the web server (nginx add_header, Apache Header set), in a CDN such as Cloudflare (Transform Rules), in your hosting dashboard, or in your application framework. Add one at a time and check the site still works — especially the Content-Security-Policy, which is best introduced in report-only mode. The CSP Generator and Permissions-Policy Generator build those two for you.
How the check works
Browsers are not allowed to read another website's headers directly, so the address is fetched by this site's small checking service on Cloudflare's network. It requests the page once, follows up to five redirects, reads only the response headers and returns them; the page itself is never downloaded or stored. Private, local and internal addresses are refused, and each visitor can run about 30 checks a minute. The result reflects what the server sends to a normal browser request at that moment.
Limits
Headers can differ between pages, so check the important ones — the home page, the login page and an account page. Some protections, such as HSTS preloading, can't be seen in a single response. A good grade is a strong start, not a full security review: keep software updated and test your application itself as well.
Frequently asked questions
Can I see every header the site sends?
Yes. Open All response headers under the results.
Do redirects affect the result?
Redirects are followed, up to five, and the final page's headers are graded.
Will adding headers slow my site down?
No. Headers add a few hundred bytes and no extra requests.
How do I check my website's security headers?
Enter the address and press Check headers.
What is a good grade?
A or A+. Most sites can reach A by adding a few headers.
Which security headers should every site have?
Strict-Transport-Security, Content-Security-Policy, X-Frame-Options or frame-ancestors, X-Content-Type-Options and Referrer-Policy.
Why is my site graded F?
It doesn't end up on HTTPS, or most key headers are missing.
Is the page content downloaded?
No. Only the response headers are read.
Can I check internal or local sites?
No. Private and local addresses are refused.
How often can I check?
Up to 30 checks a minute.
Related tools
CSP GeneratorBuild a Content-Security-Policy header or meta tag from a strict starting point, and check any policy for common weaknesses.
Permissions-Policy GeneratorBuild the Permissions-Policy header that turns off the camera, microphone, location and other browser features your site doesn't use.
SRI Hash GeneratorCreate Subresource Integrity hashes (sha384 and more) for scripts and stylesheets, with the ready script or link tag to paste.
security.txt GeneratorCreate a valid security.txt file (RFC 9116) so researchers know how to report vulnerabilities — with checks for every field.
Sitemap ValidatorCheck an XML sitemap or sitemap index against the sitemaps.org rules: syntax, namespace, URLs, lastmod dates, changefreq, priority, limits.
Robots.txt Generator & TesterCreate a robots.txt with rules per crawler, AI crawler blocking and sitemap lines, then test any URL against any robots.txt file.