Nutter Tools
Nutter Tools

A free toolbox that runs in your browser. A tool for every job.

Your files never leave your device

Images

  • Convert images
  • Compress images
  • Resize images
  • Crop
  • Watermark

PDF & files

  • Merge PDFs
  • Split a PDF
  • Images to PDF
  • PDF to images
  • Remove photo location

Video & audio

  • Compress video
  • Convert video
  • Video to GIF
  • Convert audio
  • Trim audio

Everyday

  • QR codes
  • Passwords
  • Time zones
  • Unit converter
  • Word count
  • Webcam test

Developer

  • JSON formatter
  • Base64
  • Regex tester
  • Hashes
  • JWT decoder

Site

  • About
  • Contact
  • Settings
  • Privacy
  • Terms
  • Site map
  • llms.txt

Everyday

  • Images
  • Video
  • Audio
  • PDF & files
  • Text
  • QR codes
  • Units & math
  • Time & dates
  • Color
  • Passwords & IDs
  • Device tests
  • Sun & moon

For developers

  • JSON
  • Encoding
  • Regex & cron
  • Web & auth
  • Hashing & encryption
  • Config files
  • Network
  • Browser
  • AI
  • Fake data
© Nutter Toolsnutter.tools
  1. Home
  2. Network
  3. HSTS checker
Your files stay on your device

HSTS checker

Read a domain's Strict-Transport-Security header and report max-age, includeSubDomains and preload with what each part means.

This tool is in beta

Still being tested. If a result looks wrong, tell us.

Report a problem

Press the button to read the header

Nothing leaves this page until you do. The check reads one Strict-Transport-Security header and explains each part of it against the common minimums.

The header shown is what one GET from this project's proxy received at check time. Browsers only honor it on HTTPS responses, so the request always goes out over https. The preload directive is consent, not membership: whether the domain actually rides in the list browsers ship is a separate question, and the HSTS Preload Checker on this site answers that one. A CDN or reverse proxy in front of the origin may set or strip the header itself, so what you see here is what that edge answered, not necessarily what the origin is configured to send.

Target

Bare hostname or an https:// URL

What leaves your browser

The host you enter is fetched once through this project's capped proxy server (GET only, public hosts only, size and time caps, rate-limited), because a browser cannot read another origin's response headers itself. The request always goes out over HTTPS; only the response headers and status come back. This page leaves your browser only when you press the button; never on load, never in the background. Nothing is sent anywhere else. Google Analytics still measures the visit to this page, and it never receives what you run through this tool.

More network tools

  • HTTP header parser
  • HTTP timing probe
All network tools

Was this tool useful?