Nutter Tools
Nutter Tools

A free toolbox that runs in your browser. A tool for every job.

Your files never leave your device

Images

  • Convert images
  • Compress images
  • Resize images
  • Crop
  • Watermark

PDF & files

  • Merge PDFs
  • Split a PDF
  • Images to PDF
  • PDF to images
  • Remove photo location

Video & audio

  • Compress video
  • Convert video
  • Video to GIF
  • Convert audio
  • Trim audio

Everyday

  • QR codes
  • Passwords
  • Time zones
  • Unit converter
  • Word count
  • Webcam test

Developer

  • JSON formatter
  • Base64
  • Regex tester
  • Hashes
  • JWT decoder

Site

  • About
  • Contact
  • Settings
  • Privacy
  • Terms
  • Site map
  • llms.txt

Everyday

  • Images
  • Video
  • Audio
  • PDF & files
  • Text
  • QR codes
  • Units & math
  • Time & dates
  • Color
  • Passwords & IDs
  • Device tests
  • Sun & moon

For developers

  • JSON
  • Encoding
  • Regex & cron
  • Web & auth
  • Hashing & encryption
  • Config files
  • Network
  • Browser
  • AI
  • Fake data
© Nutter Toolsnutter.tools
  1. Home
  2. Network
  3. HTTP methods exposure checker
Your files stay on your device

HTTP methods exposure checker

Send one OPTIONS request to a host and rate which HTTP methods it advertises, never trying anything state changing.

This tool is in beta

Still being tested. If a result looks wrong, tell us.

Report a problem

A passive public check

Nothing leaves this page until you do, and what leaves is one OPTIONS request, the read-only verb that asks a server to describe itself. No method is ever tried to see what happens.

Findings grade the advertisement, not behavior: an Allow header listing PUT says the server claims to know PUT, and confirming whether it enforces authentication on that route needs your own review, because this tool will never send one. A 405 to OPTIONS is often deliberate hardening, not a fault. The wildcard Allow that some servers send is reserved in RFC 9110 and means nothing to conforming clients. Results describe what one OPTIONS answer said at check time; routes differ per path, so an API route and the homepage can legitimately advertise different lists.

Target

Bare hostname or an http(s):// URL

What leaves your browser

One OPTIONS request is sent to the host you name, through this project's capped proxy server (public hosts only, size and time caps, rate-limited). No method beyond that single OPTIONS is ever tried: no write attempt, no probe to see what happens. This page leaves your browser only when you press the button; never on load, never in the background. Nothing is sent anywhere else. Google Analytics still measures the visit to this page, and it never receives what you run through this tool.

Was this tool useful?