# BuildToolForge

> Free online tools for developers, IT and security teams and website owners: 10 tools in 4 categories (DNS & Networking, HTTP, Security, Encoding), each with a short verdict, a practical explanation and an in-depth guide. No signup, no paywall. Most checks run entirely in your browser; the SSL certificate and security headers checks use a small lookup service and send only the domain you enter. Every page is available in nine languages.

## DNS & Networking Tools
- [DNS Lookup](https://buildtoolforge.com/tools/dns-lookup): Free DNS lookup tool. Query A, AAAA, CNAME, MX, TXT, NS, SRV and PTR records for any domain, read every TTL, and compare Cloudflare, Google and Quad9.
- [SPF, DKIM and DMARC Checker](https://buildtoolforge.com/tools/spf-dkim-dmarc-checker): Free SPF, DKIM and DMARC checker. Look up a domain’s email authentication records, count SPF DNS lookups, find DKIM keys and read the DMARC policy. No signup.

## HTTP Tools
- [HTTP Status Codes](https://buildtoolforge.com/tools/status-codes): Free searchable HTTP status code reference. Look up any code from 100 to 511, see what it means, which class it belongs to and when a server should send it.
- [API Rate Limit Calculator](https://buildtoolforge.com/tools/rate-limit-calculator): Free API rate limit calculator. Turn your backend capacity into a per-client requests per second limit, window quota, token bucket size and Retry-After value.

## Security Tools
- [SSL Certificate Checker](https://buildtoolforge.com/tools/ssl-checker): Free SSL certificate checker. Enter a domain to see its issuer, validity dates, days remaining and the names the certificate covers. (Uses a lookup service; only the domain is sent.)
- [Security Headers Checker](https://buildtoolforge.com/tools/security-headers): Free online security headers checker. Scan any site for CSP, HSTS, X-Content-Type-Options and more, and see which are missing or weaker than they look. (Uses a lookup service; only the domain is sent.)
- [JWT Decoder](https://buildtoolforge.com/tools/jwt-decoder): Free JWT decoder. Paste a JSON Web Token to read its header, payload and claims, with the expiry shown as a readable date. Runs in your browser; nothing is uploaded.
- [CSP Generator](https://buildtoolforge.com/tools/csp-generator): Free CSP generator. Build a Content-Security-Policy header directive by directive, start from presets, check it for weaknesses and copy it for Nginx or Apache.

## Encoding Tools
- [Base64 Encoder and Decoder](https://buildtoolforge.com/tools/base64-encode-decode): Free Base64 encoder and decoder. Convert text to Base64 or decode it back, with URL-safe output, padding and UTF-8 handled correctly. Runs in your browser.
- [URL Encoder and Decoder](https://buildtoolforge.com/tools/url-encode-decode): Free URL encoder and decoder. Percent-encode text or a whole URL, decode %XX back to text, and see every query parameter. UTF-8 safe, runs in your browser.

## Browse
- [All tools](https://buildtoolforge.com/tools): Explore 10 free online tools across 4 categories - DNS & networking, HTTP, security and encoding - each with a step-by-step guide. No sign up required.
- [Tool categories](https://buildtoolforge.com/tools/categories): Browse 10 free online tools across 4 categories: DNS & networking, HTTP, security and encoding. No signup and privacy-first.
- [DNS & Networking Tools](https://buildtoolforge.com/tools/categories/dns-networking): Browse free DNS & Networking tools. Look up DNS records and check email authentication. No signup, privacy-first, and they run in your browser.
- [HTTP Tools](https://buildtoolforge.com/tools/categories/http): Browse free HTTP tools. Status codes and API rate-limit planning. No signup, privacy-first, and they run in your browser.
- [Security Tools](https://buildtoolforge.com/tools/categories/security): Browse free Security tools: check SSL certificates and security headers, build a CSP and decode JWT tokens. No signup and privacy-first.
- [Encoding Tools](https://buildtoolforge.com/tools/categories/encoding): Free Base64 and encoding tools. Encode and decode Base64 and URL data in your browser — no signup, privacy-first, and nothing is uploaded.

## Guides
- [URL Encoding Explained: Percent-Encoding, %20 and Common Bugs](https://buildtoolforge.com/blog/url-encoding-guide): How percent-encoding works, which characters need it, encodeURI vs encodeURIComponent, when a space is + or %20, and how to fix %2520 and other URL bugs.
- [Base64 Explained: How Encoding and Decoding Really Work](https://buildtoolforge.com/blog/base64-encode-decode-guide): How Base64 turns bytes into text, why there are two alphabets, what padding is for, and why encoding is never encryption.
- [JWT Explained: How to Decode and Debug JSON Web Tokens](https://buildtoolforge.com/blog/jwt-decoder-guide): What a JSON Web Token contains, how to decode one safely, which claims cause a 401, and why decoding a token is never the same as verifying it.
- [How to Read a DMARC Report (Without Drowning in XML)](https://buildtoolforge.com/blog/how-to-read-a-dmarc-report): What a DMARC aggregate report contains, how to read the XML row by row, how to tell your own forgotten senders from spoofing, and how to get safely to p=reject.
- [404 vs 410: What Each One Tells Google About a Dead Page](https://buildtoolforge.com/blog/404-vs-410): What a 404 and a 410 each tell a crawler, how fast each one drops out of the index, when to redirect instead, and why a soft 404 is worse than both.
- [Why Your SPF Record Keeps Failing (and How to Fix It)](https://buildtoolforge.com/blog/spf-record-not-working): How to read your SPF record, why the ten-lookup limit breaks it silently, why forwarded mail fails, and how to fix a record that keeps returning softfail.
- [301 vs 302 Redirects: Which to Use and What SEO Sees](https://buildtoolforge.com/blog/301-vs-302-redirects): When to use a 301 and when a 302, what each one does to your rankings, and how to check which redirect a URL actually returns.
- [How to Fix an Expired SSL Certificate (Step by Step)](https://buildtoolforge.com/blog/fix-expired-ssl-certificate): Your site shows a certificate expired warning. How to confirm it is really expiry, renew and install the new certificate, and stop it happening again.
- [CNAME vs A Record: Which to Use and the Apex Rule](https://buildtoolforge.com/blog/cname-vs-a-record): When to use a CNAME and when an A record, why your root domain cannot be a CNAME, what ALIAS and CNAME flattening do, and what to put at the apex instead.
- [Why DNS Changes Take Time: TTL and Propagation Explained](https://buildtoolforge.com/blog/why-dns-changes-take-time): A DNS change is not slow, it is cached. What TTL controls, why your update is not visible yet, how long it takes, and how to plan a change with no downtime.
- [HTTP Security Headers: A Complete Guide to CSP, HSTS and the Rest](https://buildtoolforge.com/blog/security-headers-guide): What each HTTP security header does, which ones matter, how to roll out a Content-Security-Policy without breaking your site, and how to check your own.
- [HTTP Status Codes: A Complete Guide to Every Response Code](https://buildtoolforge.com/blog/http-status-codes-guide): What every HTTP status code means, when to return which one, how 301 and 302 differ, and how status codes affect SEO. With a free, searchable code reference.
- [API Rate Limiting: A Complete Guide to Limits, Bursts and Backoff](https://buildtoolforge.com/blog/rate-limiting-guide): How API rate limiting works: token bucket, leaky bucket and sliding windows, how to pick limits, which headers to send, and how clients should handle a 429.
- [SPF, DKIM and DMARC: A Complete Guide to Email Authentication](https://buildtoolforge.com/blog/email-authentication-guide): Learn how SPF, DKIM and DMARC stop email spoofing, how to read each DNS record, and how to roll out a DMARC policy without losing legitimate mail.
- [SSL Certificate Checker: A Complete Guide to Checking SSL/TLS Certificates](https://buildtoolforge.com/blog/ssl-checker-guide): Learn how to use an SSL certificate checker to inspect any domain's SSL/TLS certificate: issuer, validity dates, days remaining, and covered names.
- [DNS Lookup: A Complete Guide to Querying Domain Records](https://buildtoolforge.com/blog/dns-lookup-guide): Learn how to use a DNS lookup tool to query A, AAAA, MX, TXT, NS and other records for any domain, read TTL, and troubleshoot DNS problems fast.
- [Blog](https://buildtoolforge.com/blog): Step-by-step guides to DNS, SSL, HTTP, JWT and email security, with walkthroughs you can follow on your own domain or site.

## Languages
- [English](https://buildtoolforge.com/)
- [Español](https://buildtoolforge.com/es/)
- [Français](https://buildtoolforge.com/fr/)
- [Deutsch](https://buildtoolforge.com/de/)
- [Português](https://buildtoolforge.com/pt/)
- [Русский](https://buildtoolforge.com/ru/)
- [हिन्दी](https://buildtoolforge.com/hi/)
- [العربية](https://buildtoolforge.com/ar/)
- [日本語](https://buildtoolforge.com/ja/)

## Coming next
- JSON Formatter, Hash Generator, Redirect Checker, HTTP Header Checker, DNS Propagation Checker, Password Generator, Unix Timestamp Converter, UUID Generator, Subnet Calculator, What's My IP, Meta Tags Generator, robots.txt Generator

## About
- [About BuildToolForge](https://buildtoolforge.com/about): About BuildToolForge: free, fast and private online tools, each paired with a clear guide that explains the result. No signup, no paywall.
- [Contact](https://buildtoolforge.com/contact): Contact BuildToolForge for help with our free online tools. Report a bug, request a tool, or share feedback. No signup needed, fast response.
- [Privacy Policy](https://buildtoolforge.com/privacy): BuildToolForge Privacy Policy: tools run in your browser where possible, we use Google Analytics and Microsoft Clarity, may show AdSense ads, and never sell data.
- [Terms of Service](https://buildtoolforge.com/terms): The Terms of Service for BuildToolForge. Free online developer tools with no account required. Your rights, fair-use guidelines, and how advertising works.
- [Cookie Policy](https://buildtoolforge.com/cookies): The BuildToolForge Cookie Policy. Google Analytics and Microsoft Clarity measure site usage, AdSense may set advertising cookies, and you can decline at any time.