Nutter Tools
Nutter Tools

A free toolbox that runs in your browser. A tool for every job.

Your files never leave your device

Images

  • Convert images
  • Compress images
  • Resize images
  • Crop
  • Watermark

PDF & files

  • Merge PDFs
  • Split a PDF
  • Images to PDF
  • PDF to images
  • Remove photo location

Video & audio

  • Compress video
  • Convert video
  • Video to GIF
  • Convert audio
  • Trim audio

Everyday

  • QR codes
  • Passwords
  • Time zones
  • Unit converter
  • Word count
  • Webcam test

Developer

  • JSON formatter
  • Base64
  • Regex tester
  • Hashes
  • JWT decoder

Site

  • About
  • Contact
  • Settings
  • Privacy
  • Terms
  • Site map
  • llms.txt

Everyday

  • Images
  • Video
  • Audio
  • PDF & files
  • Text
  • QR codes
  • Units & math
  • Time & dates
  • Color
  • Passwords & IDs
  • Device tests
  • Sun & moon

For developers

  • JSON
  • Encoding
  • Regex & cron
  • Web & auth
  • Hashing & encryption
  • Config files
  • Network
  • Browser
  • AI
  • Fake data
© Nutter Toolsnutter.tools
  1. Home
  2. Network
  3. HSTS preload checker
Your files stay on your device

HSTS preload checker

Check whether a domain is actually in the HSTS preload list browsers ship, reported as preloaded, pending, unknown or rejected.

This tool is in beta

Still being tested. If a result looks wrong, tell us.

Report a problem

This checks the list itself, not your header

Nothing leaves this page until you do. The preload list is the dataset compiled into browsers; whether a domain is in it is separate from whether the site sends a Strict-Transport-Security header. Read the header first with the HSTS Checker on this site, then check membership here.

The four states come straight from the Chromium preload list's status API. Preloading is effectively a one-way decision: once a domain ships in browser builds, removal requests take a long time to propagate because every browser only updates the list on its own release cycle. A rejection is not a ban. The most common causes are a missing includeSubDomains, a max-age under 18 weeks, or any subdomain that does not serve HTTPS on every host; fix the cause and submit again at hstspreload.org.

Target

Bare hostname; a scheme is stripped

What leaves your browser

The hostname you enter is sent once to hstspreload.org's public status endpoint, the Chromium project's own API for the preload list browsers ship. Nothing else is contacted and nothing is stored. This page leaves your browser only when you press the button; never on load, never in the background. Nothing is sent anywhere else. Google Analytics still measures the visit to this page, and it never receives what you run through this tool.

More network tools

  • HTTP header parser
All network tools

Was this tool useful?