How to Use the Pigfox Tools — A Beginner's Guide
This page explains, in plain language, every free tool on Pigfox: what it does, when you'd reach for it, and exactly how to use it — step by step. No technical background needed.
Many of these are OSINT tools — open-source intelligence, which just means finding out things from information that is already public, gathered in one place and made easy. Others analyze a page or an email you point them at. None of them break into anything or touch private data; they only read what you give them or what is already out in the open. Use them responsibly and within the law.
Here's what's covered, grouped by what each tool is for. This index is generated from the tool registry, so every live tool is listed automatically — a link jumps to its guide below; a tool whose guide is still being written is marked.
OSINT & security checks
- TraceCheck — Score a person or entity's public footprint from live search signals.
- Domain Recon — Passive reconnaissance on a domain from public records.
- EXIF Metadata Check — Read the hidden metadata a photo carries, including GPS location.
- Fake Recruiter Check — Check whether a recruiter message shows the patterns of a scam.
- Job-Offer Legitimacy Check guide coming soon — Surface signals to investigate in a job offer or recruiter message, plus the sender domain's age.
- Candidate Photo Verify guide coming soon — Reverse-image evidence for recruiters: see where else a candidate's photo appears online.
- Timeline Discrepancy Checker guide coming soon — Check a résumé for internal-consistency signals: overlapping roles, date-vs-total mismatches, gaps, and impossible tech or certification dates.
- Email Header Analyzer — Trace the Received hop chain and read SPF, DKIM and DMARC results.
- Website Legit Check guide coming soon — Check a website's trust signals in one pass — domain age, TLS, redirects, email-security DNS, and security headers.
- Phishing & BEC Email Analyzer — Score a suspicious email for phishing and payment-redirect patterns.
- DNS Email-Security Check — Analyze a domain's SPF (with the 10-lookup limit), DMARC policy (p/pct/rua/sp), auto-probed DKIM selectors and MX, with a plain-language deliverability verdict.
- Data-Breach & Exposure Check — Check whether an email address appears in known data breaches.
- Certificate-Transparency Subdomain Finder — Discover a domain's subdomains from public certificate-transparency logs.
- Prompt-Injection & System-Prompt-Leak Tester — Test an LLM system prompt against the OWASP LLM Top 10.
- Username Checker — Check whether a username exists across a curated set of platforms.
- Security Headers Grader guide coming soon — Grade a site's HTTP security headers (CSP, HSTS, framing, nosniff, and more).
- SSL/TLS Certificate Checker guide coming soon — Inspect a domain's live TLS certificate: issuer, SANs, expiry, chain, and TLS version.
SEO & marketing analyzers
- AI-Access Checker guide coming soon — See which AI crawlers your robots.txt allows or blocks, plus llms.txt and a JS-dependency check.
- Open Graph / Social Preview Checker guide coming soon — Check a page's Open Graph and Twitter Card tags and preview its social card.
- Cognitive Load Analyzer guide coming soon — Analyze a web page's design-induced friction across cited dimensions.
- Keyword Generator guide coming soon — Turn a product or page description into structured keyword ideas grouped by theme and intent.
- Salary Counter-Offer Script guide coming soon — Draft a salary counter-offer email, talking points, and a fallback line from a plain description of your offer.
- Homepage Density Optimizer guide coming soon — Find the optimal number of homepage items by maximizing traffic × conversion, with a closed-form Lambert-W solution.
Utilities
- Redirect Chain Tracer guide coming soon — Trace every hop a URL redirects through and flag downgrades, loops, and meta-refresh.
The tools at a glance:
| Tool | What it checks | You provide | Best for |
|---|---|---|---|
| Email Header Analyzer | An email's route, SPF/DKIM/DMARC results, and sender-identity mismatches | The raw email headers | Checking whether a suspicious email is genuine |
| Phishing Analyzer | Phishing & BEC warning signs, with an advisory risk score | A suspicious email (headers + body) | Deciding whether a scary-looking email is a scam |
| DNS Security Check | SPF, DMARC, MX & DKIM strictness, with an anti-spoofing grade | A domain (optional DKIM selector) | Checking if your domain can be spoofed |
| Domain Recon | A website's public DNS records and subdomains | A domain (e.g. example.com) | Due diligence on a company or site |
| Subdomain Finder | A domain's subdomains from certificate-transparency logs, with issuer & validity | A domain | Mapping your own attack surface |
| TraceCheck | Whether a person has the public footprint they claim (0–100 advisory score) | Name + claimed role (optional photo) | Vetting a stranger who contacted you |
| Fake Recruiter Check | A recruiter's footprint plus a scam red-flag checklist | Recruiter's name (optional photo) | Sanity-checking an out-of-the-blue job offer |
| Username Check | Where a username exists across a curated set of platforms | A username | Mapping a public footprint by handle |
| Breach Check | Whether an email appears in known data breaches, and what was exposed | An email address | Finding out if your accounts are compromised |
| Prompt-Injection Tester | Whether an LLM system prompt resists 5 attack categories (OWASP LLM Top 10) | Your system prompt | Hardening an AI feature's system prompt |
| EXIF Metadata | Hidden data inside a photo (GPS, camera, date) | An image file, up to 5 MB | Checking what a photo reveals before you post it |
If your question is whether a particular email address has been exposed in a data breach, rather than whether a single message is genuine, use the Breach Check in the Identity group below.
1. Email Header Analyzer
What it is. Every email carries hidden headers that record which servers it passed through and whether it passed the standard anti-forgery checks. The Email Header Analyzer reads those headers and lays them out in plain terms: the route the message took, the SPF/DKIM/DMARC results, and whether the visible sender matches the address the mail actually came from.
When you'd use it. An email looks like it's from your bank, a colleague, or a service you use, and you want to check whether it's genuine before clicking anything.
How to use it, step by step:
- Open the message and find its raw headers — in Gmail, the three-dot menu → Show original; in Outlook, File → Properties or View → Message details.
- Copy everything and paste it into the box.
- Click Analyze headers. The report appears immediately below.
How to read the result. A green run of SPF, DKIM, and DMARC all passing is a good sign. A fail — especially DMARC — or a From domain that doesn't match the Return-Path is worth pausing over. The Received table shows the message's journey from origin to your inbox; unusual origins or long unexplained delays can be telling.
Good to know (privacy). The headers you paste are read during your request and then discarded — nothing is stored. The analysis is entirely local and never contacts the sender's servers.
Try the Email Header Analyzer →
2. Phishing & BEC Analyzer
What it is. Where the Email Header Analyzer inspects the technical route of a message, the Phishing Analyzer reads the content of a suspicious email and scores how likely it is to be a scam. It looks for the tricks phishing and "business email compromise" messages rely on: lookalike domains, links that hide their true destination, high-pressure language, requests to confirm a password, and sudden changes to bank details.
When you'd use it. An email tries to alarm or rush you — "your account will be suspended," "confirm your password," "our bank details have changed" — and you want a second opinion before you act.
How to use it, step by step:
- Copy the suspicious email — ideally the raw source, including headers and the HTML body (in Gmail, Show original).
- Paste it into the box and click Analyze email.
- Read the score and the checklist of signals that fired, each with the exact snippet that triggered it and what to do about it.
How to read the result. The score is out of 100 and grouped into low, medium, or high. It's advisory — a high score means "treat this as hostile and verify," not a courtroom verdict. The value is in the checklist: it shows you why the email looked risky, so you learn the patterns.
Good to know (privacy). The email is analyzed in memory during your request and discarded. Nothing is stored, and the tool never contacts the sender or opens any link.
3. DNS Security Check
What it is. The previous two tools help you judge an email you received. This one checks an email domain from the defender's side: does it stop other people from sending fake mail in its name? It reads the domain's SPF, DMARC, and (optionally) DKIM records and grades how spoof-proof it is.
When you'd use it. You own or manage a domain and want to know whether scammers can impersonate it — or you're vetting a company's security hygiene.
How to use it, step by step:
- Enter a domain like
example.com. - Optionally add a DKIM selector if you know it (found in a sent message's
DKIM-Signatureheader, thes=value). Leave it blank otherwise. - Click Check DNS security.
How to read the result. You get a letter grade from A to F and a card for each record. SPF ending in -all and DMARC at p=reject is the gold standard; ~all or p=none means protection is partial. Each card includes the exact fix to raise your grade.
Good to know. The tool only reads public DNS. It never sends email and never connects to the domain's servers.
Domain
4. Domain Recon
What it is. Every website lives at a domain (like example.com). Behind that domain is a set of public "phone book" entries called DNS records that say where the site lives and who handles its email. Domain Recon looks those up for you, and also tries to discover the domain's subdomains (like mail.example.com or staging.example.com).
When you'd use it. You're checking out a company, doing a bit of due diligence, or you're simply curious how a website is set up.
Which one do I want? Reach for Domain Recon when you want a broad profile of a domain — its addresses, mail servers, name servers and text records, with subdomains alongside them.
How to use it, step by step:
- Type a domain like
example.com— just the domain, with nohttp://and no path after it. - Click Run recon. Results appear below after a few seconds.
How to read the result. You'll see several lists, each explained here in plain terms:
- IPv4 / IPv6 (A / AAAA) — the numeric internet addresses the domain points to.
- Mail servers (MX) — the servers that receive the domain's email.
- Name servers (NS) — who runs the domain's DNS (often the hosting or DNS provider).
- TXT records — miscellaneous text notes, like anti-spam settings and verification tokens.
- Subdomains — other hostnames under the domain, discovered from public certificate logs.
Good to know (limits). The tool is completely passive — it only reads already-published information and never contacts the target's own servers. The subdomain part uses a free public service (crt.sh, a log of website security certificates), which can sometimes be slow or unavailable. If that happens, the DNS records still show and a short note explains that subdomain discovery was skipped.
5. Subdomain Finder
What it is. Every time a website gets an HTTPS certificate, that certificate — including the hostname it covers — is written to a public log called certificate transparency. The Subdomain Finder searches those logs to list a domain's subdomains, like mail.example.com or staging.example.com, along with who issued each certificate and when it's valid.
When you'd use it. You manage a domain and want to see everything of yours that's exposed to the internet — including forgotten staging or admin hosts that are easy to overlook and risky to leave running.
Which one do I want? Reach for the Subdomain Finder when the only question is enumerating subdomains from certificate logs, with the issuer and validity of each certificate.
How to use it, step by step:
- Enter a domain like
example.com. - Click Find subdomains and wait a few seconds.
- Review the table of discovered subdomains, each with its certificate issuer and validity dates.
How to read the result. Each row is a hostname that has had a public certificate. Look for anything you didn't expect — old test sites, admin panels, or services you thought were retired — and make sure each is patched, protected, or shut down.
Good to know. This is passive: it only reads public certificate logs and never scans or contacts the domain's servers. Use it on domains you own or are authorized to assess. A free shared log source can occasionally be slow; a note will tell you if so.
Identity
6. TraceCheck
What it is. Imagine someone emails you claiming to be a recruiter at a big company, or an investor, or a hiring manager. TraceCheck helps you answer one simple question: does this person actually exist in public, under the name and role they claim? Real professionals usually leave traces — a company profile, past roles, news mentions. TraceCheck runs a live web search and gives you an advisory footprint-consistency score out of 100, along with the links it found.
When you'd use it. A stranger reaches out with an opportunity that sounds great, and you want a quick gut-check before replying or sharing anything about yourself.
How to use it, step by step:
- In Subject name, type the person's full name (for example, Jane Smith).
- In Claimed role, type the role they say they have — for example recruiter, VC partner, hiring manager, or a company name.
- Optionally, attach a profile photo they sent you. This runs a reverse-image / "catfish" check to see whether the picture belongs to someone else.
- Click Check footprint and wait a few seconds — it's running a real search, so it isn't instant.
How to read the result. You'll get a score out of 100, a count of how many signals were found, and a list of evidence links (things like a Wikipedia page, LinkedIn profile, or news articles). A higher score means lots of consistent public presence was found. A low score means very little verifiable footprint turned up — which is a reason to be careful and dig deeper, not proof that the person is a scammer. It's an advisory signal to use alongside your own judgement.
Good to know (limits). You get 3 free checks in a rolling 30-day window. After that you'll see a friendly "paid checks coming soon" message instead of a result.
7. Fake Recruiter Check
What it is. Fake recruiters are one of the most common job scams — someone poses as a recruiter for a real company to get money or personal details out of you. The Fake Recruiter Check is a focused version of TraceCheck built for exactly this situation: it runs the same public-footprint search (with the role already set to "recruiter") and pairs it with a checklist of warning signs.
When you'd use it. A recruiter messages you out of the blue — maybe with an offer that seems too good to be true — and something feels off.
How to use it, step by step:
- Enter the recruiter's name. The Claimed role field is already filled in as "recruiter," so you don't have to.
- Optionally attach the profile photo they used, for a reverse-image / catfish check.
- Click Check footprint and wait a few seconds for the advisory score and evidence links.
Watch for these red flags (any one is worth pausing over; several together is a strong warning):
- Messaging from a free email address (like gmail) instead of a real company domain.
- Asking you to pay for training, equipment, or an "onboarding kit."
- Pressure and urgency — "the offer expires today."
- Rushing you off-platform to WhatsApp or Telegram.
- Little or no verifiable public footprint under their name.
How to read the result & limits. Just like TraceCheck, the score is an advisory signal — a low score means "verify further," not "definitely a scammer." Use it together with the red-flag checklist above. This tool shares the same 3-free-checks-per-30-days allowance as TraceCheck.
Try the Fake Recruiter Check →
8. Username Check
What it is. People tend to reuse the same handle everywhere. The Username Check takes a username and looks for it across a curated set of platforms, showing you where a profile with that name exists and linking straight to it. It's a footprint tool, like a lightweight TraceCheck keyed on a handle instead of a name.
When you'd use it. To see how far your own handle spreads across the web, or to gather public profile links for someone during due diligence.
How to use it, step by step:
- Enter a username like
octocat. - Click Check username and wait a few seconds while the platforms are checked in parallel.
- Review the grid: each platform shows found, not found, or unknown, with a link to any profile found.
How to read the result. "Found" means a profile with that name exists on that site — not that it belongs to a particular person, since handles are widely reused. "Unknown" means the site blocked or didn't give a reliable answer. Use the found profiles as leads to verify, not as proof of identity.
Good to know. The checks are passive — they only request public profile pages — and run against a fixed, curated list of sites, so the tool can't be aimed at arbitrary targets. It's rate-limited to stay a good citizen.
9. Breach Check
What it is. Companies get hacked, and when they do, their users' email addresses and passwords often end up in public leaks. The Breach Check tells you whether your email address has appeared in any known breach, which ones, and what kind of data was exposed — so you know which passwords to change.
When you'd use it. Periodically, or right after you hear a service you use was hacked, to see whether your address is caught up in it.
How to use it, step by step:
- Enter one of your own email addresses.
- Click Check for breaches.
- Read the list of breaches, when each happened, and what was exposed.
How to read the result. If your address turns up, don't panic — it usually means a site you signed up for was breached, not that you did anything wrong. Change any password you reused, starting with your email and bank, and turn on two-factor authentication. If nothing is found, that's reassuring but not a guarantee; keep using unique passwords.
Good to know (privacy). Your email is used only to run the lookup during your request and is never stored or added to any list.
AI and LLM
This group covers the AI side of the toolkit; for how systems like these are designed and run in production, see the LLM engineering work behind this site.
10. Prompt-Injection Tester
What it is. If you build anything on top of an AI model, you write a system prompt — the hidden instructions that tell the model how to behave. Attackers try to break those instructions ("ignore everything above and…") or trick the model into revealing them. This tool reads your system prompt and tells you, category by category, whether it's likely to hold up, mapped to the industry-standard OWASP LLM Top 10.
When you'd use it. Before shipping an AI chatbot, assistant, or agent — or when reviewing one — to catch weak spots in its instructions.
How to use it, step by step:
- Paste your system/developer prompt into the box (no secrets or API keys — they aren't needed).
- Click Analyze prompt.
- Read the per-category verdicts and the concrete rule each one suggests adding.
How to read the result. Each of five attack categories comes back hardened, partial, or vulnerable, with a plain explanation and a fix you can paste straight into your prompt. A "hardened" result is encouraging but not a guarantee — always follow up with real adversarial testing.
Good to know (safety & privacy). This is analysis only: it evaluates the text you paste locally and never sends your prompt to any model, attacks any endpoint, or makes any outbound request. Nothing is stored. It's the defensive companion to the LLM engineering work behind this site.
Try the Prompt-Injection Tester →
Files and Photos
11. EXIF Metadata
What it is. When a phone or camera takes a photo, it often tucks hidden details inside the image file — this is called EXIF metadata. It can include the exact GPS location where the photo was taken, the camera or phone model, and the date and time. This tool reads that hidden data and shows it to you.
When you'd use it. You want to know whether a photo reveals where it was taken — for example, to check what one of your own photos might be giving away before you post it, or to understand a picture someone sent you.
How to use it, step by step:
- Click to choose an image file — a JPEG, PNG, or WebP, up to 5 MB.
- Click View metadata.
How to read the result. If the photo carries metadata, you'll see it laid out clearly: if there's a location, you get the GPS coordinates plus a map link; you'll also see the camera make and model, the date taken, and technical details like dimensions and orientation. If you instead see "No metadata found," that's completely normal — screenshots and photos saved from social media usually have their metadata stripped away, so there's simply nothing hidden to show.
Good to know (privacy). Your image is never stored. It's read to pull out the metadata during your request and then discarded — nothing is written to disk or a database.
Beyond the hosted tools
Not everything Pigfox publishes runs in your browser. repo-quarantine is a downloadable shell toolkit rather than a hosted tool: it runs an untrusted repository inside a disposable VirtualBox VM, so whatever the code does stays inside a sandbox you throw away afterwards. Reach for it when you want to inspect or actually run a repository you don't trust, without risking the machine you're sitting at.
A note on responsible use: these tools only surface information that is already public. Use what you find thoughtfully, respect people's privacy, and stay within the law and any applicable authorization.