About Bluebench

Why it exists

Checking a suspicious link, decoding a token or reading email headers shouldn't mean pasting incident data into a site that logs it, shows you ads or wants a subscription. Bluebench puts those everyday tools in one place, works without an account, and does as much as it can inside your browser.

What it will never do

• Charge for a tier, show ads or load tracking scripts.
• Log what you paste. Decoders and the email header analyzer never send it anywhere.
• Send an indicator to our server until you press Check reputation or Check domain.
• Store your own API keys anywhere but your browser.

The privacy policy lists exactly what leaves your browser, what's stored and for how long.

Where the answers come from

Reputation lookups use abuse.ch (URLhaus, ThreatFox and MalwareBazaar) and Google Safe Browsing, within each source's terms. With your own keys you can add VirusTotal, AbuseIPDB, GreyNoise and AlienVault OTX. Domain checks read public DNS through Cloudflare's 1.1.1.1 and certificates from crt.sh or SSLMate's Cert Spotter. A result of "not listed" means just that: it's never a promise that something is safe.

Service status

Checking…

Open source

Every line is public under the MIT licence on GitHub, so you can check these promises for yourself, report a bug or send a fix. Found a security problem? Email security@bluebench.dev.

Support it

Bluebench runs on donations and on Cloudflare's free tier. If it saves you time, a donation keeps it free for everyone.