01
WAN IDENTITY
{{ wanStateLabel }}
PUBLIC IPv4
{{ wanIp4 }}
NOT DETECTED
PUBLIC IPv6
{{ wanIp6 }}
NOT DETECTED
CONNECTED VIA{{ wanVia }}
ISP{{ wanIsp }}
ASN{{ wanAsn }}
GEO{{ wanGeo }}
TIMEZONE{{ wanTz }}
POSTAL{{ wanPostal }}
EDGE{{ wanColo }}
✕ LOOKUP UNAVAILABLE — host offline or request blocked.
Resolves live when served over a real network connection.
⦸ EXTERNAL LOOKUPS DISABLED
Your IP is not being queried. Re-enable in the PRIVACY module.
02
ATOMIC TIME
{{ clockLocal }}
{{ clockDate }}
UTC{{ clockUTC }}
NTP SOURCE{{ ntpSource }}
CLOCK DRIFT{{ ntpDelta }}
SESSION UPTIME{{ uptime }}
03
WEBRTC LEAK TEST
{{ leak }}
{{ leakDesc }}
LOCAL CANDIDATES
{{ ip }}
No local interfaces exposed by the browser.
DNS LEAK TEST
◢ RESOLVING THROUGH YOUR DNS…
{{ dnsLeakConclusion }}
{{ dnsLeakCount }} RESOLVER(S) SAW YOUR QUERIES
{{ d.org }}
{{ d.count }} addr · {{ d.loc }}
{{ d.ips }}
{{ dnsLeakErrText }}
04
NETWORK LATENCY
⦸ EXTERNAL LOOKUPS DISABLED
{{ t.label }}{{ t.disp }}
05
THROUGHPUT
{{ spdState }}
⦸ EXTERNAL LOOKUPS DISABLED
This test transfers data to and from shucky.io. Re-enable in the PRIVACY module.
DOWN
{{ spdDown }}Mbps
UP
{{ spdUp }}Mbps
PING{{ spdPing }}
JITTER{{ spdJitter }}
EDGE{{ spdEdge }}
{{ spdNote }}
Expect this to read lower than a dedicated speed-test service, especially above ~500 Mbps. Those spread a test across many servers and connections; a browser opens one HTTP/2 connection per origin, so every stream here shares a single congestion window to a single edge. It is a floor, not a ceiling.
06
CISA KEV · ACTIVELY EXPLOITED
{{ kevMeta }}
◢ PULLING KNOWN-EXPLOITED-VULNERABILITIES FEED…
✕ FEED UNREACHABLE
Live CISA catalog loads when served over a real network connection.
⦸ EXTERNAL LOOKUPS DISABLED
Enable external lookups to pull the live CISA catalog.
{{ v.cve }}
{{ v.date }}
{{ v.name }}
{{ v.vendor }} · {{ v.product }}
◢ SEARCHING CATALOG…
No matches in the KEV catalog.
Enable external lookups to search the catalog.
Search failed — try again.
07
DNS LOOKUP · DoH
◢ QUERYING…
⦸ EXTERNAL LOOKUPS DISABLED
{{ r.type }}
{{ r.data }}
{{ r.ttl }}s
{{ dnsErrText }}
08
SUBNET / CIDR CALC
NETWORK{{ snNetwork }}
BROADCAST{{ snBroadcast }}
NETMASK{{ snMask }}
WILDCARD{{ snWildcard }}
HOST RANGE{{ snFirst }} – {{ snLast }}
USABLE HOSTS{{ snHosts }}
CLASS / SCOPE{{ snClass }} · {{ snScope }}
✕ {{ subnetErrText }}
09
PASSWORD FORGE
{{ pwValue }}
LENGTH · {{ pwLength }}{{ pwStrength }} · {{ pwEntropy }} bits
10
HASH GENERATOR
SHA-1
{{ hashSha1 }}
SHA-256
{{ hashSha256 }}
SHA-512
{{ hashSha512 }}
11
HTTP / HEADER PROBE
⚠Authorized use only — probe systems you own or have explicit permission to test. Unauthorized scanning may violate law or terms of service.
◢ CONNECTING…
{{ probeCode }}
{{ probeMsg }}
{{ h.name }}{{ h.value }}
✕ {{ probeErr }}
{{ probeMsg }}
12
CLIENT FINGERPRINT
{{ ua }}
PLATFORM{{ uaPlatform }}
CPU CORES{{ uaCores }}
MEMORY{{ uaMem }}
SCREEN{{ uaScreen }}
VIEWPORT{{ uaViewport }}
TIMEZONE{{ uaTz }}
LANGS{{ uaLang }}
TOUCH{{ uaTouch }}
DO-NOT-TRACK{{ uaDnt }}
COOKIES{{ uaCookies }}
13
CODENAME FORGE
{{ wordsValue }}
DESIGNATION
{{ wordsNum }}
COMMON SYMBOLS
!
@
#
$
%
^
&
*
(
)
-
_
=
+
?
/
14
PASSPHRASE FORGE
{{ passValue }}
WORDS · {{ passCount }}{{ passStrength }} · {{ passEntropy }} bits
Memorable words are easy to recall and, at enough length, harder to crack than short random strings. Generated locally with crypto-grade randomness.
15
TOKEN DECODER
🔒Decoded entirely in your browser — nothing is sent anywhere. The signature is not verified.
✓ JWT{{ tokenExp }}
HEADER
{{ tokenHeader }}
PAYLOAD
{{ tokenPayload }}
BASE64 DECODED
{{ tokenPayload }}
✕ {{ tokenErrText }}
Paste a full JWT (header.payload.signature) or any base64 / base64url string.
16
PORT REGISTRY
{{ portHint }}⚠ = SECURITY-SENSITIVE
{{ p.label }}
{{ p.name }}
{{ p.desc }}
No matching port or service.
17
IP INTEL
🌐Look up geolocation, network, and ASN for any public IP. The IP you enter is sent to ipwho.is.
◢ RESOLVING…
{{ ipIp }}{{ ipType }}
COUNTRY{{ ipCountry }}
CONTINENT{{ ipContinent }}
REGION{{ ipRegion }}
CITY{{ ipCity }}
ASN{{ ipAsn }}
TIMEZONE{{ ipTz }}
ISP / ORG
{{ ipIsp }}
✕ {{ ipIntelErrLabel }}
{{ ipIntelErrMsg }}
18
MAIL POSTURE
◢ RESOLVING MX · SPF · DKIM · DMARC…
⦸ EXTERNAL LOOKUPS DISABLED
{{ mailErrText }}
WHAT GETS CHECKED · REFERENCE
{{ rc.n }}
{{ rc.wt }}
{{ rc.t }}
{{ rc.e }}
Enter a domain and press ANALYSE. CORE and MAJOR findings drive the grade, HARDENING nudges it, INFO never counts.
{{ mailGrade }}
{{ mailAnalysed }}
{{ mailSummary }}
Weighted: authentication (MX · SPF · DKIM · DMARC) counts heavily, optional hardening lightly, INFO not at all.
{{ c.status }}
{{ c.label }}
{{ c.detail }}
MAIL EXCHANGERS · IP · REVERSE DNS
{{ m.pref }}
{{ m.host }}
{{ m.ip }}
{{ m.ptr }}
PUBLISHED RECORDS
{{ r.label }}
{{ r.value }}
Every check above is a DNS lookup made from your browser — nothing is sent to a server. Blacklist (DNSBL) and SMTP banner / STARTTLS tests are deliberately absent: every major blocklist refuses queries arriving from public resolvers, and browsers cannot open raw SMTP connections. MTA-STS is verified at the DNS record only; the policy file is not fetched.
