All-in-One Free Online Tools for Everyone

BuildToolForge is a growing collection of free, browser-based utilities for developers, IT and security professionals, writers, and anyone who needs a quick, reliable answer. Each one handles a single everyday technical check — the kind that comes up in web, DNS and security work — and explains the result clearly, so one place covers jobs that would otherwise send you across a dozen different websites.

What sets BuildToolForge apart is the step-by-step guide attached to every page. Instead of dumping raw output and leaving you to decipher it, each result is explained — what the value means, why it matters, and what to do next — so you learn while you work. New utilities are added regularly based on what people are actually searching for, and you can browse the full library or filter by category to reach exactly what you need in a couple of clicks.

Everything runs in your browser wherever possible, which keeps the data you enter on your own device, with no signup, installation, or paywall to get in the way. BuildToolForge is free to use and always will be — and if something you need is missing, or a result could be clearer, the contact page is the fastest way to tell us. Much of what gets built next comes straight from suggestions like yours.

Most website and email problems start with a symptom rather than a clear question. Find the symptom that matches yours below and you will know which page to open first, what to look for in the answer, and what usually fixes it.

A domain does not load or still points to the old server

Run a DNS lookup and compare the A and AAAA records with the address your hosting provider gave you. If they differ, the change has not reached that resolver yet, and the TTL shows how many seconds the old answer can stay cached. The NS records tell you which provider actually answers for the domain, which is the first thing to confirm after moving a site.

Email lands in spam or bounces

Check SPF, DKIM and DMARC together. A sending service that is missing from SPF, an SPF record above the ten-lookup limit, or a DMARC policy with no reporting address are the most common causes. Every finding comes with the exact record to change, so the fix usually takes a few minutes at your DNS provider.

Visitors see a certificate warning

Inspect the SSL certificate the server presents: who issued it, when it expires and which hostnames it covers. A missing www name, an expired certificate or an incomplete chain explains almost every browser warning, and the days-remaining figure tells you how urgent the renewal is.

A security scan reports missing headers

Scan the page’s response headers to see which protections are present, which are missing and what each one does, from HSTS to clickjacking protection. When the report asks for a Content Security Policy, the CSP generator builds one that you can paste into your server or CDN configuration.

An API returns errors or 429 responses

Look up the HTTP status code first: the reference explains what the server is really telling the client and whether a retry makes sense. Then use the rate limit calculator to turn a request budget into delays and burst sizes that stay safely inside the limit.

A login token is rejected

Paste the JSON Web Token into the JWT decoder to read its header and claims. An expired exp value, the wrong audience or an unexpected signing algorithm is usually visible at a glance, and the token never leaves your browser while you inspect it.

Text or links arrive garbled

Encoding is the usual suspect. Decode the value with the Base64 decoder or the URL decoder to see what is really inside, or encode it correctly before you place it in a query string, an HTTP header or a data URI.

A page redirects to the wrong place

Check which redirect status the server sends. A 301 or 308 is permanent and is cached by browsers and search engines, while 302 and 307 are temporary; using the wrong one can keep visitors on an old address long after you change it. The HTTP category explains each code and when to use it.

You want to harden a new site before launch

Work through the Security category in order: confirm the certificate covers every hostname, add the missing security headers, roll out a Content Security Policy in report-only mode first, and check that your tokens expire when they should. Twenty minutes before launch saves an awkward scan report afterwards.

If your problem is not listed, open the page closest to the symptom: every result explains what was found and what to do next. And if you are still stuck, write to us through the contact page — real questions like yours shape what we build next.