About

ZeroAuthority is a security research platform for analysts, defenders, and engineers. It combines live security tooling, a self-hosted vulnerability database, private case management, an encrypted secret vault, and a tracker for internet outages in one place. Most of it works without an account; an account adds more tools and a private workspace.

The tools workspace has 102 tools, organised into 14 categories. Each category has its own page, so checklists, guides, lookups and utilities are never mixed in one long list:

• Personal safety (7): Check links, messages, QR codes, shops and offers before you trust them.
• Privacy (12): Passwords, metadata, data brokers and your rights over your personal data.
• Checklists (2): Repeatable review checklists and audit-readiness trackers.
• Network (5): Subnets, ports, DNS, addresses and ASN ownership.
• Domain intelligence (4): Registration data, email authentication and lookalike domains.
• Web security (8): Headers, TLS, CORS, CSP and exposed files for websites.
• Security analysis (11): CVEs, hashes, certificates, indicators and detection rules.
• Research (8): Attack surface, graphs, evidence packs and bulk analysis.
• Monitoring (3): Track certificates, domains and infrastructure changes.
• Incident response (10): Timelines, playbooks, severity scoring and chain of custody.
• Reports (2): Risk registers and incident reports ready to share.
• Cloud and DevOps (8): Containers, Kubernetes, Terraform, IAM, APIs and supply chain.
• Engineering (3): Diagrams, request templates and API response diffs.
• Utilities (19): Encoders, validators, converters and PC diagnostics.

Three tiers: 36 are Public (no account needed), 12 are Free (a free account), and 54 are Paid. Live lookups (DNS, WHOIS / RDAP, TLS, security headers, email security, certificate transparency, attack surface mapping, and others) run real queries from our servers. Utilities like hash, JWT, regex, Base64, and encoding tools run entirely in your browser, so the data you paste never leaves your device.

The Utilities category includes everyday Windows help tools: an error code lookup, a Windows 11 compatibility check, a process explainer, a PC fix command generator, an Event ID lookup, a file extension lookup, a hardware ID decoder, a disk health explainer, and a crash explainer. They are free to use without an account and run entirely in your browser, so what you paste never leaves your device. The explanations come from a hand-written reference built into the site, not from an AI model, so an unfamiliar code may come back as not found rather than a guess.

Every tool has an Example button that fills in a realistic example for the options you selected, and every result can be copied or downloaded as TXT or JSON. Most tools can also export the result as a branded PDF report. The PDF is built in your browser from the result already on your screen, so exporting it sends nothing extra to us.

Transparency is the point of the site, so every result that comes from an outside source names it. Live lookups list the registries, databases and public services they asked, and browser-only tools say that nothing left your device. Checklists and guides that follow a published standard link to or name that standard.

Inside an investigation you can open any tool from the case itself and attach its result as evidence, so you never have to leave the case to gather results. A person who only wants a quick answer from a tool is never shown case options.

The PC Specs Checker is free for every account. Because Windows will not let a web page read your hardware, you download a small .bat file, run it, and we match the result to your account. We know that running a file from a website is a real ask, so this is exactly what it does.

What it reads: your computer make and model, BIOS version and date, motherboard model, boot mode (UEFI or Legacy), Windows version and uptime, processor model, cores and load, RAM size, speed and slots, graphics adapters and driver dates, screen resolution, drive models, types, sizes and health, and free space per drive letter.

What it never reads: your name, computer name, Windows username, serial numbers, MAC or IP addresses, Wi-Fi names or passwords, installed programs, running processes, browsing history, documents, photos, the clipboard, or anything inside your files. It does not read the contents of any drive.

What it does not do: it does not need administrator rights, install anything, add startup entries, change settings, or leave files behind except one readable copy of its findings next to the file, which you can delete.

You stay in control: the full script is shown on the tool page before you download it and you can open the .bat in Notepad. After downloading, we show a SHA-256 fingerprint so you can confirm the file is untouched. Nothing leaves your PC until you open the file. Once opened it runs on its own with no prompts, prints everything it found and sends it to your account, so read it in Notepad first if you want to check. The file is not code-signed, so Windows may warn about an unknown publisher; that is expected, and it is why we make the script readable instead of asking for trust.

What we do with it: the file carries a one-time key that works once and expires after 30 minutes, which is how we match the scan to your account. The server keeps only a fixed list of fields and discards anything else, even if the script were edited. The scan is stored encrypted, shown only to you, and deleted automatically after 24 hours or sooner if you press delete. The analysis and PDF are created in your browser. We do not use scans for ads, profiling or sale. The tool works on Windows 10 and 11 only.

The CVE Lookup tool searches our own copy of every official CVE record from 1999 to today. It doesn't call third-party search APIs. It's free and needs no account, with higher limits when you sign in (see the rate limits below). A scheduled job pulls new and updated records once a day from the official CVE List V5. Records are enriched with FIRST EPSS exploit-probability scores and CISA Known Exploited Vulnerabilities status.

Tools come in three tiers. Public: 36 tools need no account at all, including the browser-only utilities and personal-safety checkers, plus CVE Lookup and WHOIS / RDAP. Free: 12 more need a free account because they make live requests from our servers or produce documents. Paid: 54 advanced tools need a paid plan, which also roughly triples your allowance.

Limits are counted per account, or per IP address for the Public tier, in a rolling one-minute and one-hour window. Hit either one and requests are paused until the window resets. The error message tells you how many seconds to wait.

Paid is a higher allowance, not an unlimited one. Limits keep the service fast for everyone and protect the third-party sites our lookups contact.

36 tools are Public and work with no account, 12 are Free and need a free account, and 54 advanced tools are Paid. Free tools send you to sign in, and Paid tools send you back to the tools list, where the Upgrade page explains how to request access.

Paid access is granted by the ZeroAuthority team. Open Upgrade from the menu, send a short request, and we review it. You get an email when access is granted that states how long it lasts, when it started, and when it ends.

We pick the length when granting access: 1 hour (free trial), 7 days, 30 days, 3 months, 12 months, unlimited (no expiry). The one-hour option is a free trial.

When time runs out, or your access is revoked, the change is immediate. Paid tools lock, the Free limits apply on your very next request, and you get an email explaining what happened. You can request access again at any time. Accounts that already have paid access cannot send new requests.

Investigations is a private case tracker for signed-in users. Each case records what happened, when it started and when it was detected, severity, a status (Pending, In progress, On hold, Done or Cancelled), the response taken, and a due date. Closing a case records the time to close, and overdue open cases are flagged. Tool results can be saved to a case as evidence.

Every case has an automatic timeline. You cannot add or delete entries by hand, so it works as an audit trail: every change is recorded as it happens, including edits to the title, summary, response and outcome (with the text before and after), category, priority, dates, tags, status changes and saved tool results. Removed content stays in the timeline too.

Any case can be exported as a PDF report that includes the full timeline. Cases are visible only to you: we cannot see their names, notes, timelines or saved results.

The evidence locker keeps documents, screenshots, logs and written notes in one place and links them to the investigations they support. Every item gets a SHA-256 fingerprint when it is stored, so you can show later that it has not changed. You have 100 MB in total, shared across all your files and notes. Files and notes are encrypted before they are saved, and you can export your evidence index as a PDF. It is available to signed-in users from the Evidence tab beside Secrets and Investigations.

The secret vault stores API keys and credentials encrypted at rest, with expiring share links that never expose the raw value. It is available to signed-in users. We cannot list, read or decrypt your secrets, and cannot see their names or notes.

Every PDF ZeroAuthority produces (investigation reports, evidence indexes and tool results) carries a unique code that looks like ZA-XXXX-XXXX-XXXX. Anyone, including a court, an employer or an insurer, can enter that code on the verify page without an account. If we issued it, the page shows a verified result with the kind of document, when it was generated in your local time, and the username of whoever generated it. Unknown codes are shown as not verified, so a forged document cannot pass.

You can also attach the PDF itself on the verify page. We compare its SHA-256 fingerprint with the one we recorded when it was created, so an edited file is flagged even if the code is real. The file is checked in memory and is not stored. The registry holds only the code, document kind, tool name, time, username and fingerprint. It never holds the contents of a report, and it never shows an email address.

Codes are permanent. A verification code stays in our database forever, even after the investigation or evidence it came from is deleted, and even after the account that created it is deleted. Deleting your data removes the report content from our systems, but a document you have already handed to someone remains verifiable. The registry is locked at the database level, so a code cannot be deleted or edited once it exists. The only thing that is ever added is the file fingerprint recorded when the document is created.

Every account has a unique username. It is the only identity shown on reports and in the verification registry; your email address is never printed on a document. You can change your username once every six months from Account settings.

This is exactly what we can and cannot see.

What we can see: your name, email address, verification status and plan, plus any support tickets and upgrade requests you choose to send us.

What we cannot see: the names, descriptions, timelines, notes or saved results of your investigations, the files and notes in your evidence locker, or the names, notes and values of your stored secrets.

Tools: utilities that run in your browser never send what you paste to us. Live lookups send your query to our servers so they can ask public sources for the answer. We do not store those inputs or results unless you save one to an investigation. We count requests per account or IP address to enforce rate limits, not what the requests contained. Each PDF you generate adds one row to the verification registry (code, kind, time, username and fingerprint), never its contents.

PC Specs Checker: this is the one tool where data comes from a file you run on your own PC. When you open the file, the hardware details listed above are sent to us and stored encrypted for 24 hours so your report can load. We can only read them in the context of showing them back to you. You can delete a scan at any time from the tool page.

How it is stored: data lives in our database. Secrets, evidence files and notes are encrypted at rest, and every database table enforces row-level security so your rows are only reachable as you. Investigation PDFs are generated only when you ask, kept encrypted for two minutes, and then discarded. Because the service has to decrypt your data to show it back to you, this is not end-to-end encryption, so do not store anything you could not accept a server operator being technically able to reach.

Deleting your data: deleting your account from Account settings permanently removes your investigations, timelines, evidence, saved results, secrets and share links. Support tickets you sent are kept for our records, and so are the verification codes of documents you generated: each code, its document kind, time, username and fingerprint stay in the registry forever so those documents can still be verified.

The outages page lists current internet disruptions at the top and past outages below. An outage moves to the past list as soon as its end time passes or its source stops reporting it. Select any outage to see its cause, scope, region and timing. Data comes from Cloudflare Radar and IODA (Georgia Tech), so coverage is limited to what those sources detect and is not a complete picture of the internet.

CVE Program (CVE List V5), FIRST EPSS, CISA KEV, OSV.dev, deps.dev, IANA RDAP bootstrap and authoritative registries, Cloudflare and Google DNS-over-HTTPS, crt.sh Certificate Transparency, Team Cymru IP-to-ASN, Cloudflare Radar, and IODA. Each tool lists the sources it used next to its results.

Questions or problems? Visit Support. To keep the queue manageable, each account can have one open ticket at a time; you can send another once it is fixed or cancelled.