Free tool · No sign-up · Server-assisted
CORS Tester
Send a preflight and a real request to any endpoint and read back exactly what it allows: which origins, which methods, which headers, and whether credentials are permitted. Spells out the common misconfigurations — a wildcard origin paired with credentials, a reflected Origin that trusts everyone — rather than leaving you to infer them.
Server-assisted · we send a preflight from a random test origin to see what the endpoint allows
Method & assumptions
- This is a server-assisted tool. It sends a request from a deliberately random Origin, so an endpoint that echoes that Origin back is genuinely reflecting it, not matching an allowlist that happens to include you.
- Only the URL you enter is sent, and only to our server, which probes it once. Nothing is stored.
- A wildcard origin combined with credentials is rejected by browsers — it is flagged as a misconfiguration, not an open door, because credentialed requests will simply fail.
- Reflecting any origin while allowing credentials is the dangerous case: it lets any site make authenticated requests as your users.
Plate —Other tools
More on the bench
- 01Supabase Security AuditorPoint it at your project, find the holes.
- 02JWT DecoderPaste a token, read what is inside.
- 03Secret & .env ScannerPaste code or a .env, catch the leaked keys.
- 04Security Headers ScannerEnter a URL, grade its headers.
- 05Base64 Encode / DecodeText or files, both directions.
- 06URL Encode / DecodePercent-encoding, both directions.
- 07JSON FormatterValidate, pretty-print, or minify.
- 08UUID Generatorv4 and v7, one or a thousand.
Free diagnosticsSame-day dispatchNamed techniciansDone or free
Need it built, not just checkedWe write the software
We write the software
behind tools like these
Anyone staring at a CORS error, or checking their own API is not open to every origin on the web.