Methodology

Exactly how each tool works and where its data comes from.

Security Headers Checker

One GET request is sent to the URL you provide (following redirects). Seven response headers are evaluated with fixed weights: CSP (25), HSTS (20), X-Content-Type-Options (15), X-Frame-Options or CSP frame-ancestors (15), Referrer-Policy (10), Permissions-Policy (10), Server version leakage (5). Pass = full weight, partial/weak = half, missing = zero; grades map A ≥ 90%, B ≥ 75%, C ≥ 55%, D ≥ 35%, else F. The response is graded and discarded — nothing is stored.

DNS Lookup

Queries are forwarded to Cloudflare's public DNS-over-HTTPS resolver (cloudflare-dns.com) and rendered verbatim. The SPF/DMARC check runs two TXT lookups and applies published RFC 7208 / RFC 7489 qualifier semantics — nothing more.

CVE Lookup

Data comes from the NIST National Vulnerability Database 2.0 API, cached at the edge for 24 hours. We show NVD's own CVSS metrics, CISA KEV fields, CWE weaknesses, and references — never our own scores.

Security Headers Generator

Config snippets are assembled locally from fixed templates — the recommended values are exactly the ones the checker grades as a pass (one-year HSTS with includeSubDomains, a starter CSP with no unsafe-inline, nosniff, dual frame protection, strict-origin-when-cross-origin, a deny-by-default Permissions-Policy). The two tools share one standard on purpose: fix with the generator, verify with the checker. The starter CSP is a floor, not a finished policy — extend it for what your site loads.

CVSS 3.1 Calculator

Scores implement the FIRST CVSS v3.1 specification verbatim: the published metric weights, the impact and exploitability sub-score formulas with scope-changed adjustments, the spec's round-up function, and temporal modifiers that can only hold or lower the base score. Severity bands are the spec's own (0 None, 0.1–3.9 Low, 4.0–6.9 Medium, 7.0–8.9 High, 9.0–10.0 Critical). The formula is deterministic; the metric choices are your judgment — which is why your score can legitimately differ from NVD's for the same CVE.

Password tools (Strength Checker, Passphrase Generator, Entropy Calculator, Brute-Force Estimator)

All four run entirely in your browser; no password or generated secret is ever transmitted. Entropy is computed as length × log2(pool), where the character pool is 26 (lowercase) + 26 (uppercase) + 10 (digits) + 33 (symbols) for the classes present. The strength checker starts from that figure and subtracts bits for predictable structure — an exact match against a short breached-password sample, a common base word, sequences (abc/123), keyboard runs (qwerty), 3+ repeats, or a four-digit year — then maps the result to a band and to crack times at 10², 10⁴, and 10¹¹ guesses/sec. This is a deliberately lightweight heuristic, not a cracking model like zxcvbn or hashcat, so it can over- or under-rate a specific password; it never claims otherwise. The generator uses crypto.getRandomValues with rejection sampling (no modulo bias) and a wordlist bundled into the page; entropy is the real list length, and the list is BlueTeamKit's own, not a diceware/EFF standard. The entropy calculator and brute-force estimator assume uniform-random characters, so their numbers are an upper bound — a human-chosen password of the same length is weaker, and the estimator's times (half the keyspace divided by the guess rate) are best cases that dictionaries and pattern rules beat in practice.

Client-side tools (JWT, Decoder Toolbox, Email Header Analyzer)

These run entirely in your browser using standard APIs (TextEncoder/TextDecoder, WebCrypto digest, atob/btoa). Your input is never transmitted — verify with your browser's network inspector. The email analyzer parses RFC 5322 headers and reports mismatches and Authentication-Results verdicts; it does not and cannot declare a message safe.

Limits, honestly

A header grade is not a security audit. A DNS answer is one resolver's view. A decoded JWT is not a validated one. Each tool states its own limits on its page; if a result seems surprising, verify with a second source.