Web Tools
Every Web Tools tool on Toolz.dev: 3 free utilities that run entirely in your browser. No signup, no uploads, no downloads.
These four tools work on the plumbing between a browser and a server: the name that points at a host, the header a browser sends about itself, the header a server demands before it answers, and the pass a crawler makes over a page. None of them produce anything a visitor sees. All of them decide whether the request works at all.
What you reach for depends on which end you are debugging. Registering or auditing a name goes through bulk domain availability. A request that behaves differently for one visitor usually comes down to the string their browser sent, which the user agent parser breaks into browser, engine, operating system and device. A staging site that should not be public needs an HTTP Basic auth credential - one header, no login page to build. And a page that reads correctly to a person but not to a model is what AI Scan reports on, crawler by crawler.
Which of the four answers your question
| If you are asking | Use | What you get back |
|---|---|---|
| Is this name available, and on which TLDs? | Domain search | Availability across many extensions at once |
| What is this visitor actually running? | User agent parser | Browser, version, engine, OS and device type |
| How do I lock a staging site quickly? | Basic auth generator | An htpasswd line and the matching Authorization header |
| Can an AI crawler read this page? | AI Scan | Per-crawler access, plus what each one can extract |
Why a user agent string cannot be trusted, only parsed
The User-Agent header is the least reliable field a browser sends, and it has been that way deliberately for thirty years. Every browser claims to be Mozilla because sites once served a worse page to anything that did not; Chrome claims to be Safari, Safari claims to be KHTML, and Edge claims to be Chrome. The string is a fossil record of compatibility fights rather than a description of the software.
That is why parsing it is a different job from reading it. A parser knows the order the tokens appear in and which claim wins, so it can tell you that a string announcing Mozilla, AppleWebKit, Chrome and Safari all at once is Chrome on macOS. Use the result for analytics, for reproducing a bug someone reported, and for deciding which build to hand a visitor. Do not use it for security or for feature detection - the header is set by the client and can say anything, and feature detection answers the real question directly.
Google announced in 2020 that it would freeze and eventually reduce the string, and Chrome now ships User-Agent Client Hints alongside it. The header has not gone away, and the frozen version still carries a platform and a major version, so parsing it remains the fastest way to turn a log line into something you can act on.
HTTP Basic auth is small enough to be the right answer
Basic authentication is defined in RFC 7617 and is about as simple as an auth scheme gets: the client sends `Authorization: Basic ` followed by `username:password` in Base64, and the server either accepts it or answers 401. There is no session, no cookie, no form and no state. That makes it a poor fit for an application and an excellent fit for putting a wall in front of something that is not ready to be public.
The two things it produces are different and both useful. The htpasswd line goes on the server, where the password is stored as a bcrypt or MD5 hash rather than in the clear. The Authorization header goes in the client - a curl call, a webhook you are testing, a CI job that has to fetch a protected URL. Base64 is not encryption, so the credential is readable by anything on the wire; Basic auth over plain HTTP hands the password to the network, and the scheme is only safe behind TLS.
Checking a name before you commit to it
Domain availability looks like a single yes or no and is really a spread. The same name is free on one extension, parked on another and held by a registrant on a third, and the answer changes by the hour. Checking a list of extensions in one pass is the difference between choosing a name and discovering, three days later, that the version you wanted was taken while you deliberated.
Availability is also not the whole question. A name that is free today may have been dropped by a previous owner, along with whatever reputation that owner earned, so a free name with a history is worth a look at the Wayback Machine before you register it.
Frequently asked questions
- What is a user agent string?
- A user agent string is the value of the User-Agent HTTP header, which a browser sends with every request to describe itself. It lists a sequence of product tokens and versions - typically Mozilla, a rendering engine, the browser, and the platform - and servers read it to identify the client. It is set by the client, so it can be changed or spoofed freely.
- Can I rely on the user agent for security decisions?
- No. The header is chosen by the client and any value can be sent, so it identifies nothing and authenticates no one. Use it for analytics, bug reproduction and build selection. For deciding what a browser supports, feature detection answers the question directly rather than inferring it from a version number.
- Is HTTP Basic authentication secure?
- Basic authentication is secure enough for gating non-public content, but only over HTTPS. The credential is Base64-encoded rather than encrypted, so anything that can read the connection can read the password. RFC 7617 says as much directly. It also has no logout and no session, which is why it suits staging environments and machine-to-machine calls rather than user-facing sign-in.
- What is the difference between an htpasswd line and an Authorization header?
- The htpasswd line lives on the server and stores the password as a hash, so the server can verify a credential without holding the original. The Authorization header lives on the client and carries the username and password Base64-encoded, so the server has something to verify. You need the first to protect a directory and the second to call it from curl, a webhook or a CI job.
- Does checking a domain name make it more likely to be registered by someone else?
- Availability lookups here go to a registry API and do not reserve, register or flag the name. Front-running by registrars has been alleged over the years and ICANN investigated it in 2008 without finding systemic evidence, but the safest habit is unchanged: if you are certain about a name, register it rather than continuing to check it.
- Why would an AI crawler see a different page from a search crawler?
- Different crawlers obey different rules and run different amounts of JavaScript. Googlebot renders pages; several AI crawlers fetch the raw HTML and stop, so anything that arrives after hydration is invisible to them. robots.txt is also read per user agent, so a rule aimed at one crawler leaves the others untouched.