Coming soon — not yet launched
Automated API security scanning
EndpointCheck continuously tests that the APIs you ship enforce the access rules they are supposed to enforce — so authorization bugs get found by a machine, not by an incident.
The product isn't built yet. Join the waitlist and we'll email you once when it launches.
Free tools that work today
These are live and free. They run entirely in your browser — no account, no upload, nothing stored.
Security headers checker
Paste a raw response and see which security headers are missing or misconfigured.
CORS tester
Check a CORS preflight response against the origin and requested headers you supply.
JWT decoder
Decode a JWT header and payload in your browser. The token never leaves the page.
OpenAPI security linter
Lint an OpenAPI spec for missing auth schemes, unscoped operations, and open servers.
What we're building
Planned capabilities. None of this ships today — it's what the waitlist gets you access to when it's ready.
Continuous API inventory
Keep a live map of every endpoint you expose, including the shadow APIs that never made it into the docs.
Automated authorization checks
Continuously test that each endpoint enforces the access rules it claims to enforce.
Findings your team can act on
Reproducible evidence with the exact request that broke the rule, mapped to OWASP API Security Top 10.
No account, no free tier, no credit card
There is nothing to sign up for yet. The only thing asking you for an email address is the waitlist form above, and it exists so we can tell you when the scanner is live.
Questions people ask
Is EndpointCheck available yet?
No. It is still being built. Everything currently on this site — the free tools and the written guides — works today and is free to use. The scanning product itself is not launched.
What does the free tool set do?
Each tool analyses input you paste into the page, entirely in your browser. The security headers checker and CORS tester read raw HTTP responses, the JWT decoder reads a token, and the OpenAPI linter reads a spec. Nothing you paste is sent to a server or stored.
Do the free tools replace a security scanner?
No. They point out specific misconfigurations you can check in seconds. They are not a penetration test, do not cover every vulnerability class, and cannot prove your API is secure. See the tool disclaimer for the specifics.
Is there a free plan?
The free tools are free and have no account, no usage limits, and no sign-up. Pricing for the scanning product has not been decided yet — join the waitlist and we will tell you when that changes.
How much does the waitlist cost?
Nothing. Joining the waitlist does not commit you to anything and does not start a subscription. We will email you once when the product launches.
What happens to my email address?
It is used to send one launch announcement and nothing else. It is not sold, shared, or added to a newsletter. You can unsubscribe from that email, or delete your entry by replying to it. The privacy policy has the full detail.
Join the waitlist
One email when the scanner launches. Nothing else, ever.