Free
Reference & Standards · Security
Open Worldwide Application Security Project: standards like the Top 10.
owaspsecurityreferencebest-practices
Discover the 21 best free tools for security. Free-to-use, no credit card or subscription required. Curated, compared, and updated for developers.
| Tool | Pricing | Platforms | Top Strength | Link |
|---|---|---|---|---|
| OWASP | free | web | Open Worldwide Application Security Project: standards like the Top 10. | Details → |
| OWASP ZAP | free | desktop | Open-source web app security scanner for finding vulnerabilities in your own apps. | Details → |
| SSL Labs | free | web | Deep SSL/TLS server certificate and configuration analysis. | Details → |
| Mozilla SSL Config Generator | free | web | Generate recommended TLS configurations for many servers. | Details → |
| Security Headers | free | web | Scan any site's HTTP security response headers and get a grade. | Details → |
| CSP Evaluator | free | web | Google's tool to evaluate and debug Content Security Policies. | Details → |
| crt.sh | free | web | Search certificate transparency logs for any domain. | Details → |
| Let's Debug | free | web | Diagnose why Let's Encrypt certificate issuance fails for a domain. | Details → |
| Trivy | free | cli | All-in-one open-source vulnerability and misconfiguration scanner. | Details → |
| Gitleaks | free | cli | Detect and prevent hardcoded secrets in Git repositories. | Details → |
Showing top 10 of 21. Browse the full grid below.
Reference & Standards · Security
Open Worldwide Application Security Project: standards like the Top 10.
Reference & Standards · Security
Open-source web app security scanner for finding vulnerabilities in your own apps.
SSL & TLS · Security
Deep SSL/TLS server certificate and configuration analysis.
SSL & TLS · Security
Generate recommended TLS configurations for many servers.
Headers & CSP · Security
Scan any site's HTTP security response headers and get a grade.
Headers & CSP · Security
Google's tool to evaluate and debug Content Security Policies.
SSL & TLS · Security
Search certificate transparency logs for any domain.
SSL & TLS · Security
Diagnose why Let's Encrypt certificate issuance fails for a domain.
Dependency Security · Security
All-in-one open-source vulnerability and misconfiguration scanner.
Secret Scanning · Security
Detect and prevent hardcoded secrets in Git repositories.
Passwords & IDs · Security
Check if your email or password has appeared in known data breaches.
Passwords & IDs · Security
Generate strong, random passwords free from 1Password.
Passwords & IDs · Security
Generate UUIDs/GUIDs in bulk, including v4 and v7 versions.
Passwords & IDs · Security
Online GUID/UUID generator with many formatting options.
Reference & Standards · Security
Official W3C validator for HTML markup quality.
Headers & CSP · Security
Mozilla's scanner that grades a site's security headers and config.
Reference & Standards · Security
The canonical network scanner for auditing your own hosts and services.
Reference & Standards · Security
The world's foremost network protocol analyzer.
Penetration Testing · Security
Open-source penetration testing tool that automates SQL injection detection and exploitation.
Penetration Testing · Security
Debian-based Linux distribution shipping 600+ preinstalled penetration testing and forensics tools.
Penetration Testing · Security
Free, in-depth web security training with interactive labs, maintained by the Burp Suite team.