Nutter Tools
Nutter Tools

A free toolbox that runs in your browser. A tool for every job.

Your files never leave your device

Images

  • Convert images
  • Compress images
  • Resize images
  • Crop
  • Watermark

PDF & files

  • Merge PDFs
  • Split a PDF
  • Images to PDF
  • PDF to images
  • Remove photo location

Video & audio

  • Compress video
  • Convert video
  • Video to GIF
  • Convert audio
  • Trim audio

Everyday

  • QR codes
  • Passwords
  • Time zones
  • Unit converter
  • Word count
  • Webcam test

Developer

  • JSON formatter
  • Base64
  • Regex tester
  • Hashes
  • JWT decoder

Site

  • About
  • Contact
  • Settings
  • Privacy
  • Terms
  • Site map
  • llms.txt

Everyday

  • Images
  • Video
  • Audio
  • PDF & files
  • Text
  • QR codes
  • Units & math
  • Time & dates
  • Color
  • Passwords & IDs
  • Device tests
  • Sun & moon

For developers

  • JSON
  • Encoding
  • Regex & cron
  • Web & auth
  • Hashing & encryption
  • Config files
  • Network
  • Browser
  • AI
  • Fake data
© Nutter Toolsnutter.tools
  1. Home
  2. Web & auth
  3. Redirect chain security analyzer
Your files stay on your device

Redirect chain security analyzer

Follow a URL hop by hop and see HTTPS downgrades, cross-domain jumps, credential-bearing links and chains that run too long.

This tool is in beta

Still being tested. If a result looks wrong, tell us.

Report a problem

One request per hop

The walk sends a GET to the URL, reads its status and headers, and if it answers 3xx with a Location, repeats on the next URL. Each hop is a separate proxied request, so the chain appears exactly as a server-side client sees it.

Findings say what the chain does, not what the site intends: a cross-domain jump is normal for trackers and shorteners, and a redirect that keeps cookies is often routine. The tool sends one GET per hop through the proxy, so results reflect what the proxy's network position sees; cookies, logins, and geolocation are not replayed. Chains longer than 5 hops are flagged because each extra hop costs a full request, not because a specific length is wrong.

Chain

1 to 10 seconds

What leaves your browser

Each hop leaves this page as one GET through this project's capped proxy (public hosts only, DNS re-resolved and private ranges refused at every hop, size- and time-capped, rate-limited), because a browser tab cannot follow another site's redirects and read the hops itself. The chain runs at most 10 hops. This page leaves your browser only when you press the button; never on load, never in the background. Nothing is sent anywhere else. Google Analytics still measures the visit to this page, and it never receives what you run through this tool.

Runs on this device. Nothing is uploaded.

More web & auth tools

  • HTTP timing probe
  • HTTP status reference
All web & auth tools

Was this tool useful?