Free Cybersecurity Tools

Hands-on tools to test your defences against phishing — no account needed. Built by the team behind PhishSkill.

Prefer something interactive? Try our phishing quizzes
Checkif your domain can be spoofed. if your email is in a data breach. if a password has leaked. who really sent a suspicious email.
Free · no account

Free Tools

Run any of these in seconds — instant results, nothing to install or sign up for.

Free

Domain Security Checker

Check whether your domain can be spoofed by attackers. Instantly reviews your SPF, DKIM and DMARC email-authentication setup.

Check if your domain can be spoofed
Free

Email Exposure Check

Find out if your email address has surfaced in known data breaches, so you know which accounts to lock down first.

Check if your email is in a breach
Free

Password Breach Check

See if a password has appeared in a known breach — checked privately, so your password never leaves your browser in full.

Check if your password has been breached
Free

Email Header Analyzer

Paste a suspicious email's headers and see who really sent it — authentication results, originating server and delivery path.

Analyze a suspicious email
The full platform

From the PhishSkill Platform

The tools above are a quick one-off check. The platform does this for your whole organisation — continuously, with training, tracking and audit-ready reports.

Platform

Phishing Simulation

Send realistic, safe phishing simulations to your team on email and WhatsApp, and see exactly who clicks — so you know where the risk really is.

See how it works
Platform

Security Awareness Training

Video-based training modules organised by category, with quizzes and scoring — so you can see who's learning and who still needs a nudge.

Explore the training
Platform

WhatsApp Phishing Awareness

Take simulations and awareness onto WhatsApp — where more and more scams now land, not just the inbox.

Learn more
Platform

Phishing Report Button

A one-click Outlook button so your team can report suspicious emails — real threats reach your security team, simulations earn a positive score.

See how it works

Frequently asked questions

No. Every tool here runs instantly in your browser with no sign-up. You can optionally have a fuller report emailed to you.
Yes. The checks use public information, such as your domain's DNS records, or privacy-preserving methods, and nothing you enter is stored.
Yes. Your password is hashed in your browser and only a short, partial fingerprint is used to look for matches, so the password itself never leaves your device.
Spoofing is when an attacker forges your domain in the "from" address so a scam email looks like it came from you. Properly configured SPF, DKIM and DMARC records make that much harder, and the Domain Security Checker shows whether yours are set up.
Enter it into the Email Exposure Check. It tells you which known breaches your address has appeared in, so you know which accounts to secure first.
Every email carries hidden headers that record its true origin and authentication results. Paste them into the Email Header Analyzer for a plain-English verdict.
These tools are one-off checks you run yourself. A phishing simulation safely tests how your whole team responds to realistic scam emails over time, paired with awareness training, which is what the PhishSkill platform does.

Ready to train your whole team?

The free tools are a taste. PhishSkill runs realistic phishing simulations on email and WhatsApp, auto-assigns awareness training, and proves improvement with audit-ready reports.

Start your free trial