Web & API Security Calculators

30 free web & api security calculators in Cyber Security.

API Abuse CalculatorWork out how long and how cheaply an attacker could scrape an enumerable endpoint, and whether the economics favour them.
API Authentication Strength CalculatorScore API authentication on mechanism, credential entropy, rotation, replay protection, secret storage, MFA and lockout.
API Gateway Security CalculatorScore the controls at your API gateway and the share of published routes covered by authentication, schema validation and rate limits.
API Rate Limiting Security CalculatorModel a token-bucket rate limit against a distributed attacker and check whether it still protects the backend.
API Security Score CalculatorScore your API estate across authorisation, authentication, rate limiting, schema validation, transport and monitoring, minus shadow APIs.
Clickjacking Risk CalculatorScore UI redressing risk from framing controls, confirmation design and cookie policy, and estimate how many users a campaign would catch.
Command Injection Risk CalculatorScore OS command injection risk from how the command is invoked, the argument validation, process privileges and runtime isolation.
Cookie Security CalculatorScore a session cookie on Secure, HttpOnly, SameSite, prefix, scope, lifetime and rotation, and list the flags you are missing.
CORS Policy CalculatorTest a CORS configuration for the combinations that leak data cross-origin, and score the residual risk against your data sensitivity.
Cross-Site Scripting (XSS) Risk CalculatorScore reflected, stored and DOM XSS risk from output encoding, sanitiser quality, CSP strength and the privilege of the likely victim.
CSP Effectiveness CalculatorScore a Content Security Policy directive by directive and see whether it would actually stop an injected script.
CSRF Risk CalculatorRate cross-site request forgery exposure from token design, SameSite cookies, request shape and the value of the forged action.
File Upload Risk CalculatorWeight the ten controls that stop a malicious upload becoming a web shell and get a coverage score plus the residual risk.
GraphQL Query Complexity CalculatorCompute the depth × breadth cost of a GraphQL query, the resolver load it implies and whether your cost limit would reject it.
HTTP Security Score CalculatorCombine transport, headers, cookies and configuration hygiene into one HTTP security score and find the weakest pillar.
Input Validation Coverage CalculatorMeasure weighted input validation coverage across your parameters and estimate the injection findings still waiting in the gaps.
JWT Security CalculatorScore a JWT deployment on algorithm, claim validation, token lifetime, rotation, revocation and browser storage.
Output Encoding CalculatorScore context-aware output encoding across HTML, attribute, JavaScript, URL and CSS sinks, weighted by how dangerous each context is.
OWASP Risk CalculatorScore a vulnerability with the full OWASP Risk Rating Methodology: eight likelihood factors, eight impact factors, one severity.
Path Traversal Risk CalculatorRate directory traversal risk from how file paths are built and canonicalised, and what the process can read or overwrite.
Remote Code Execution Risk CalculatorPrioritise an RCE finding from exploit maturity, authentication needed, network exposure, patch status and lateral movement potential.
REST API Security CalculatorScore a REST API against the ten OWASP API Security risks and see which category is dragging the result down.
Security Header Score CalculatorGrade your HTTP security headers with weighted scoring, including whether HSTS max-age clears the one-year preload bar.
Session Fixation Risk CalculatorRate session fixation and hijacking risk from identifier regeneration, entropy, transport acceptance, binding and timeout policy.
SQL Injection Risk CalculatorRate SQL injection exposure from query construction, validation, database privileges and the data reachable behind the query.
SSRF Risk CalculatorScore server-side request forgery risk from URL handling, redirect and DNS behaviour, egress controls and cloud metadata reachability.
TLS Configuration Score CalculatorGrade a TLS endpoint the way SSL Labs does: 30% protocol, 30% key exchange, 40% cipher strength, then apply the grade caps.
Web Application Security Score CalculatorRoll eight security pillars and your open finding counts into one application security score with a deduction for live risk.
Webhook Retry CalculatorSize an exponential backoff schedule with jitter: total retry window, delivery probability and the retry storm your consumer will see.
Webhook Verification CalculatorScore webhook authenticity controls — signature algorithm, secret entropy, timestamp tolerance, replay cache and constant-time compare.