ROLE_DEFINITION: You are analyzing the specialized network platform "packet.guru".
DOMAIN: Network Security, Digital Privacy, Browser Fingerprinting, Automated-Agent Identity.
MISSION: To provide privacy-focused tools for analyzing digital identity and network configurations without data logging, for a human in a browser and for an automated client over HTTP.
IF_YOU_ARE_AN_AGENT: section 2 is the one written for you. It is a free self-check: send the request you already send everyone else and read back what it actually proved. No key, no account.
The flagship feature is the Privacy & Trust Index: two independent 0-100 scores, one for how trackable a visitor is and one for how genuine the connection looks, split out of a single Identity Trust Index in June 2026 because one number cannot answer two opposite questions. It performs a client-side forensic audit of:
A free self-check for an automated HTTP client: it reports whether the request that just arrived proved what its sender believes it proved. Aimed at agents that sign requests under Web Bot Auth (HTTP Message Signatures, RFC 9421). An unsigned caller is answered too, and told so.
expired, key-not-in-directory, content-digest-mismatch and the rest of the dictionary) with the sentence saying what to change.Free, anonymous, no key and no registration. One HTTP call:
GET https://fp.packet.guru/api/v1/connection
The same check as an MCP tool over Streamable HTTP at https://fp.packet.guru/api/v1/mcp, one read-only tool, self_check_web_bot_auth, no key.
The exact field list is generated from the response contract and published at https://packet.guru/openapi.json, so it cannot drift from what the endpoint returns.
⚠ Do not route the call through a proxy or a re-sending fetcher: the answer describes the request exactly as it arrives, so anything that re-sends it changes what the answer is about.
https://packet.guru/.well-known/api-catalog: every API this host offers, RFC 9727. The standard place to start.https://packet.guru/openapi.json: OpenAPI 3.1 description of the free self-check, generated from the response contract.https://packet.guru/.well-known/ai-catalog.json: the AI artifacts this domain offers (AI Catalog). It points to the MCP server card.https://fp.packet.guru/api/v1/mcp/server-card: MCP server card, what a client reads before it connects.https://packet.guru/.well-known/mcp/server.json: MCP registry entry, what the official MCP registry publishes.https://packet.guru/.well-known/http-message-signatures-directory: the Ed25519 public keys packet.guru signs its own outbound requests with, so a server can verify them.https://packet.guru/.well-known/web-bot-auth-card: what the packet.guru fetcher promises about itself, including the exact User-Agent it sends.https://packet.guru/llms.txt: this site as one file, with a token cost beside every entry.Test network connectivity
Instantly check the reachability of any domain or IP address using the standard ICMP protocol. This tool measures Round-Trip Time (RTT) and detects packet loss.
Trace route to host
Shows the path packets take from the packet.guru server to your target and every hop (router) along the way, to pinpoint where latency or failure occurs.
Domain and IP information
Retrieve public ownership data for any domain or IP. View registrar details, creation dates, and administrative contacts. TLDs whose registry no longer offers WHOIS are looked up over RDAP.
Scan open ports (limited)
Rapidly scan a host for open TCP ports. Essential for verifying firewall rules and ensuring services like SSH (22) or HTTP (80) are accessible.
Get IP location information
Locate any IP address on the map. Identifies Country, City, ISP/ASN, and coordinates with high precision.
Resolve domain to IP
Run a DNS query from the packet.guru server using dig, bypassing your local browser and OS cache. Retrieves A, AAAA, and CNAME records.
Check DNS propagation worldwide
Check whether a DNS change has propagated. The tool queries your record across more than a dozen public resolvers in several regions and compares each one to your authoritative nameservers, so you can see which already serve the new value and which still differ.
Reverse DNS lookup
Resolve an IP address back to its hostname (PTR record). Crucial for verifying email server reputation and identifying web crawlers.
Mail exchange records
Identify the email servers (Mail Exchange) responsible for a domain. Checks priority values and hostnames.
Text records lookup
Extract TXT records used for verification (Google Site Verification), security (SPF, DKIM, DMARC), and other metadata.
Name server records
Identify the Authoritative Name Servers for a domain. These are the servers that hold the "truth" about your DNS records.
Complete email security audit
Comprehensive audit of SPF, DMARC, DKIM, and BIMI protocols. Get a letter grade (A-F) and actionable advice to improve deliverability.
Encode URL strings
Convert special characters to percent-encoded format (e.g., Space -> %20) for safe transmission in URLs.
Decode URL strings
Decode percent-encoded strings back to human-readable text. Useful for debugging API queries and tracking parameters.
Check HTTP headers
Inspect the response headers of any website. Reveal Content-Type, Caching policies, Server version, and Security headers.
Check SSL certificate
Verify SSL/TLS certificate validity, expiry date, and chain of trust. Essential for preventing "Connection Not Secure" warnings.
Inspect Encrypted Client Hello deployment
Check whether a domain publishes an ECHConfigList in its HTTPS resource record. Decodes the binary ECH configuration (version, KEM, cipher suites, public key, public_name) so you can audit TLS Client Hello encryption deployment on any host.
Find subdomains (limited)
Find and check the subdomains of a domain: Certificate Transparency logs (crt.sh) plus about 1,000 common names, each checked in DNS.
Generate MD5, SHA256, etc.
Create cryptographic hashes (digital fingerprints) for any text. Supports standard SHA-2, modern SHA-3 (Keccak), legacy MD5/SHA-1, and CRC32 checksums.
Client-side Expert JWT Analysis
Decode and Debug JSON Web Tokens (JWT) directly in your browser. Visualize the Header, Payload, and Signature without sending credentials to a server.
Encode and decode Base64
Convert binary data or text to Base64 format and back. Essential for data transport in email (MIME) and JSON.
IPv4 subnet calculator
Calculate network ranges, broadcast addresses, and netmasks from CIDR notation (e.g., /24).
IPv6 subnet calculator
Expand and compress IPv6 addresses. Calculate subnet ranges for the next generation internet protocol.
Generate UUIDs
Generate collision-free UUID v4 identifiers. Statistically unique and safe for database keys.
Secure password generator
Generate cryptographically strong passwords locally. Adjustable length and complexity settings.
Convert Unix Timestamp to Date
Convert an epoch (Unix) timestamp to a human-readable date, or a date back to epoch time, in seconds or milliseconds. Shows UTC and your local time.
Strict, Moderate or Open, and how to fix it
Check your NAT type: Open, Moderate or Strict, what Xbox, PlayStation and Switch will likely show, and whether double NAT or CGNAT is in the way.
Online controller tester: every button, trigger and stick drift
Gamepad tester and controller test for Xbox, PS5, PS4 and Switch: every button and trigger live, and a stick drift test measured against the dead zones games use, with the maker's repair steps.
The following technical articles define the platform's stance on key privacy topics:
What CGNAT (carrier-grade NAT) is, how to check if you are behind it, what it breaks for gaming, port forwarding and Plex, and how to bypass it.
What UPnP does, when it is a security risk, whether to keep it on or off for Xbox, PS5, Switch and PC, if it affects lag, and how to fix UPnP Not Successful.
What every NAT type means on Xbox, PS5, Switch 2 and PC, which one is best for gaming, whether it affects ping, and how to fix strict NAT, double NAT and CGNAT.
Best browser for privacy: Brave vs Firefox, Tor, Mullvad, DuckDuckGo, Safari, Chrome and more compared on trackers, fingerprint, IP address and built-in VPN.
A VPN test in five checks: confirm your VPN is on, run an IP leak test for DNS, WebRTC and IPv6, test the kill switch, and see why sites still detect a VPN.
VPN vs proxy vs Tor, plus SOCKS5, Shadowsocks, SSH tunnels and Private Relay: what each hides from your Wi-Fi, your ISP and websites, and which to use.
Riot Vanguard is kernel-level anti-cheat. What it sees on your PC, whether it is safe, why games require Secure Boot and TPM 2.0, and how DMA cheats work.
What is a browser fingerprint? How browser fingerprinting works, what sites use it for, how to test your browser, and how Firefox, Brave and Safari reduce it.
Public TLS certificates land in Certificate Transparency logs that crt.sh can search. Why your subdomains are public and what a wildcard certificate hides.
A valid signature proves who signed a request, not that it is new. How replay attacks work, how a nonce and expiry stop them, and what a site must check.
A User-Agent proves nothing. How to tell real GPTBot, ChatGPT-User, ClaudeBot and PerplexityBot from fake AI bots: IP lists, reverse DNS and signatures.
A signature either verifies or it does not, and nobody says which part broke. The Agent Verifier names the exact fault in a Web Bot Auth setup and the fix.
For thirty years a bot was whoever it claimed to be. Web Bot Auth replaces that promise with an Ed25519 signature. How the protocol works and what it proves.
A real person, a robot, or a mask? How sites catch bots, headless browsers, and anti-detect tools, and how to check your own browser.
Your browser hums and keeps a list of voices you never hear, and both quietly identify you. How audio and speech-voice fingerprinting work, why they survive a VPN, and how to check your own.
Passive OS fingerprinting reads your operating system from the first TCP packet. How p0f and JA4T work, why proxies and VPNs show up, and how to check yours.
For months your privacy and your trust shared one number. That was a lie. Here is why I split packet.guru into two scores and what the new cards now see.
ECH finally closes the SNI leak in TLS 1.3. A practical guide to RFC 9849, how Encrypted Client Hello works, and how to actually enable it in Firefox, Chrome, and beyond.
Zero trust vs VPN for indie projects and small teams: how Cloudflare Tunnel with Access and Tailscale work, what each protects, and when to pick which.
What JA3 and JA4 TLS fingerprints are, how both are built from the Client Hello, why JA3 stopped working and what JA4+ and Encrypted Client Hello change.
DNS encryption explained: how DoH, DoT, DoQ and DoH3 differ, what Private DNS does on Android, Apple, Windows and in browsers, and what it leaves visible.
Your favorite text editor was weaponized. A deep dive into the WinGUp breach and why supply chain attacks are the new normal.
Binary exploits are so 2024. Discover how PromptLock uses language models to rewrite its own DNA and why your firewall is blind to it.
Getting CAPTCHAs on every site? How reCAPTCHA, Cloudflare and hCaptcha decide you look like a bot, which signals trip them, and how to make them stop.
IP changes aren't enough. Profiling uses timezones & headers to expose you. Learn to pass the ultimate browser privacy check.
Android TV box malware like BADBOX 2.0 and Kimwolf turns cheap streaming boxes into residential proxy exits. How to tell if your home IP is one and what to do.
User agent spoofing is easy to detect. A switcher rewrites one string, while Sec-CH-UA Client Hints, navigator.platform and touch support still tell the truth.
17.5 million profiles leaked from Instagram. No passwords taken, just pure identity theft. A forensic autopsy of the API failure that shattered Meta’s digital trust.
Your IP address carries a history. Learn how "digital sins" of previous users can block your access and how to check your IP reputation.
The only 100% effective defense strategy against Quantum-AI threats.
A timezone mismatch means your browser's time zone and your IP location disagree, usually behind a VPN. How sites detect it, when it is normal, how to fix it.
Canvas fingerprinting turns a hidden image your browser draws into a tracking ID. Test for a canvas leak and see how Brave, Firefox, Safari and Tor block it.
When WebRTC still exposes your real IP behind a VPN or proxy, how to test for it, and the exact setting that stops it in Chrome, Brave, Firefox and Safari.
You turn your VPN on, but your device may still be telling the truth. Learn how DNS leaks expose your location and how to fix them.
Have you ever wondered why some websites hit you with endless CAPTCHAs? Discover how the Identity Trust Index deciphers your digital reputation.