- TOMORIS
- Toolbox
TOMORIS TOOLBOX · FREE
CHECK SECURELY. SHARE SECURELY.
Free tools from TOMORIS for security and compliance. No account, no sign-in, right in your browser.
TOMORIS Toolbox
- Share Securely2
- Website & Server9
- Email & Domain6
- Microsoft 365 & Identity5
- Compliance & NIS29
- Generators7
- Downloads44
€0No account, no sign-in
2 TOOLS
Share Securely
Pass on passwords and files without anyone reading along. Not even us.
- drop.tomoris.ioFree
GRID.DROP (opens in a new tab)
Share documents, images and archives by link instead of as attachments. Encrypted in the browser, gone after download or after 24 hours at the latest.
- AES-256-GCM in the Browser
- Up to 90 MiB
- 1, 3 or 10 Downloads
- Deleted after 24 h
- whisper.tomoris.ioFree
GRID.WHISPER (opens in a new tab)
Share passwords, credentials and short texts by link. The key stays in the link; our server only sees encrypted data.
- AES-256-GCM in the Browser
- 1 to 10 Views
- 1 Hour to 7 Days
- No Account
9 TOOLS
Website & Server
How well is a website protected? Passive checks, as any browser sees them.
- Free
Website Security Check
Everything at a glance, with an overall grade.
Check Now (German) - Free
Security Header Check
HSTS, CSP and more in seconds.
Check Now (German) - Free
SSL/TLS Check
Check certificate and TLS versions.
Check Now (German) - Free
security.txt Check
Check and create per RFC 9116.
Check Now (German) - Free
Cookie Check
Check Secure, HttpOnly, SameSite.
Check Now (German) - Free
Mixed Content and SRI Check
Find insecure content and third-party scripts.
Check Now (German) - Free
Redirect Check
Chains from HTTP and www to the target.
Check Now (German) - Free
robots.txt and Sitemap Check
Check syntax, effect and sitemap.
Check Now (German) - Free
Website Software Notes
Server, CMS and versions at a glance.
Check Now (German)
6 TOOLS
Email & Domain
Prevent spoofed senders and outages: SPF, DKIM, DMARC, DNSSEC and your domain’s records.
- Free
Email Security Check
Check SPF, DKIM, DMARC.
Check Now (German) - Free
DNS Security Check
DNSSEC, CAA and name servers.
Check Now (German) - Free
Certificate Transparency Check
Find issued TLS certificates.
Check Now (German) - Free
Lookalike Domain Check
Find similar domains used for phishing.
Check Now (German) - Free
Link Checker
Paste a link instead of clicking it: shows who really owns the address and explains deceptions such as the @ trick, look-alike characters and redirects.
- Never Opens the Link
- @ Trick, Punycode, IP Addresses
- Short Links and Redirects
- Browser Only
- Free
Email Header Analysis
Read sender path, SPF, DKIM and DMARC.
Check Now (German)
5 TOOLS
Microsoft 365 & Identity
Microsoft 365 seen from the outside: tenant, Exchange Online and the records your domain needs for it.
- Free
Microsoft 365 Domain Check
Tenant, Exchange Online, DKIM.
Check Now (German) - Free
Microsoft 365 Endpoints
URLs and IP ranges for firewall and proxy.
Check Now (German) - Free
Entra ID Error Code Explainer
AADSTS50126, 53003 or 65001? Enter the code and read what is behind the sign-in error and who can fix it. 40 common codes, with a link to Microsoft.
- 40 Common AADSTS Codes
- Meaning and Next Step
- With Source and Date
- Browser Only
- Free
Token Decoder (JWT)
What is in an access token? Read JWT headers and payloads, with claim explanations and expiration in Vienna time. Browser only; signatures are not verified.
- Readable Header and Payload
- Microsoft Entra ID Claims Explained
- Expiration in Vienna Time
- Browser Only
- Free
Password Generator
Strong passwords or memorable passphrases from an English wordlist, generated with your browser’s random number generator. With exactly calculated entropy.
- crypto.getRandomValues
- English Wordlist (MIT)
- Entropy in Bits
- Nothing Is Stored
9 TOOLS
Compliance & NIS2
Understand the rules before they get expensive: NIS2 and more, checked in plain language.
- Free
NIS2 Applicability Check
Am I affected? In 3 minutes.
Check Now (German) - Free
Maturity Check for Municipalities
13 questions, maturity level and actions.
Check Now (German) - Free
Maturity Check for Law Firms
For lawyers, notaries and tax advisors.
Check Now (German) - Free
Maturity Check for Medical Practices
For doctors’ offices and clinics.
Check Now (German) - Free
Maturity Check for Industry
NIS2, IT/OT separation and remote maintenance.
Check Now (German) - Free
Accessibility Quick Check
Obvious issues under WCAG 2.2.
Check Now (German) - Free
Third-Party Check
Find external services and data flows.
Check Now (German) - Free
NIS2 Reporting Deadline Calculator
Enter when you became aware: early warning, notification and final report under Section 34 NISG 2026 and the GDPR’s 72 hours, also as a calendar file.
- Section 34 NISG 2026, Art. 23 NIS2
- Art. 33 GDPR
- Summer Time Included
- Calendar File (.ics)
- Free
IT Emergency Card
The card for posting: whom to call, what to say, what not to do. With your own contacts, based on the BSI IT emergency card, ready to print on A4.
- Based on the BSI Card
- Your Own Contacts
- CERT.at with Source
- Print or PDF on A4
7 TOOLS
Generators
Generate configurations instead of typing them: ready-made headers and policies for your server, right in the browser.
- Free
CSP Generator
Build and check a Content Security Policy.
Check Now (German) - Free
Security Header Generator
Header configuration for your server.
Check Now (German) - Free
DMARC Generator
Choose a level, add reporting addresses and copy the record: from p=none to p=reject, with each tag explained and guidance on common mistakes. Runs only in your browser.
- RFC 9989 (DMARC)
- From none to reject in Stages
- Authorize External Reporting Addresses
- Browser Only
- Free
SPF Generator
Select services and servers, then copy the record: counts DNS lookups against the limit of 10 and explains every mechanism. Runs only in your browser.
- RFC 7208 (SPF)
- Counts DNS Lookups (Max. 10)
- Microsoft 365 and Google Workspace
- Browser Only
- Free
MTA-STS Generator
Enter mail servers and copy the policy file, MTA-STS and TLS-RPT records: start with testing, then enforce. Runs only in your browser.
- RFC 8461 and RFC 8460
- Downloadable Policy File
- Exchange Online Template
- Browser Only
- Free
CAA Generator
Select certificate authorities, control wildcards and copy records for your DNS provider’s form or as a zone file. Runs only in your browser.
- RFC 8659 and RFC 8657
- issue, issuewild and iodef
- DNS Form and Zone File
- Browser Only
- Free
Wi-Fi QR Code Generator
Enter your guest Wi-Fi name and password, then print or download the QR code. The password stays on your device; nothing is transmitted.
- Password Stays on Your Device
- Print Layout, SVG and PNG
- WPA2 and WPA3
- Browser Only
44 PDFS
Downloads
Checklists, templates and guides as PDF, backed by sources and without registration. A selection here; all of them by topic under Downloads.
- Free
NIS2 Reporting Obligations
Early warning within 24 hours, notification within 72 hours, final report after one month: deadlines, content, and recipients with references to the NISG 2026, plus a checklist.
- With references to the NISG 2026
- Free
IT Emergency Manual
Crisis team, contact list, classification as disruption, emergency or crisis, immediate measures and recovery with RTO and RPO: a fillable outline based on BSI Standard 200-4.
- With tables to fill in
- Based on BSI Standard 200-4
- Free
Password Policy
Length instead of mandatory special characters, changes only on suspicion, blocklist, and MFA: a password policy to adapt, with an old-versus-new comparison and a checklist for Microsoft Entra ID.
- With model text to adapt
- Based on NIST SP 800-63B-4 and BSI ORP.4
- Free
AI Usage Policy
Sample text with placeholders for AI assistants: approved tools, data classes, human review, labeling and training, plus the legal status of the AI Act after the Digital Omnibus.
- With sample text to adapt
- Legal status after the Digital Omnibus
WHY FREE
Showing How
We Work.
The toolbox shows what we look for in security and compliance. If a result raises questions, we assess it together with you.
- Free and without an account
- Transparent about what happens to your input
- Results you can understand
QUESTIONS
Good to Know.
Do the tools cost anything?
No. All tools in the TOMORIS Toolbox are free and can be used without an account.
What happens to my input?
Each tool says so directly. GRID.WHISPER and GRID.DROP encrypt content in the browser; the key is in the link after the # sign and never reaches the server.
Does TOMORIS help if a result raises questions?
Yes. “Discuss the Result” puts you in touch with our team. We assess findings and suggest a sensible next step.
YOUR NEXT STEP
What should
work better
next?
Tell us briefly what you have in mind. We will assess it and suggest a sensible next step.