Google Dorks Generator
1,500+ ready-to-fire operators. Filter by category, search, copy, or open in Google.
Hackerrecon · The Private Toolkit · Zero Telemetry
Recon, decoded.
Recon, decoded.
The browser-only security toolkit. Pay once, use forever.
A single-page, browser-only workspace for authorized security reconnaissance. 2,000+ dorks, 20 precision tools, zero data egress — one-time ₹500 payment, lifetime access. Designed for bug bounty hunters, red teamers, and the deeply curious.
I
Wake to the surface
The first discipline of reconnaissance is patience — let a site give up its own architecture. Google dorks, GitHub queries, and sitemap parsing: broad, fast, exhaustive.
Google DorksGitHub ReconSitemap Inspector
II
Breathe in the data
Every token, every header, every cookie tells you something about how a system sees the world. Decode JWTs, score session flags, map the authentication surface with surgical clarity.
JWT InspectorCookie AnalyzerHTTP Header Analyzer
III
Transform what you find
Strange strings, encoded blobs, unfamiliar hashes — twenty-five encodings at your fingertips, from Base85 to HMAC to YAML. Make the opaque plain; make the complex navigable.
Encoder / DecoderHash IdentifierIP / CIDR Calculator
IV
Fortify the practice
A password is only as strong as its entropy, and a header only protects what it covers. Score, stress-test, and tighten every surface before you call it done. The craft is in the finish.
Password StrengthSEO AuditWorkflow Checklist
V
The discipline of authorization
Every tool here works on your machine and your machine alone. Authorized testing only — no data leaves the browser, no exceptions. Know the law. Stay in scope. Report responsibly. This is a craft, not a weapon.
Zero TelemetryClient-Side OnlyEducational Use
The toolkit
20 tools. One tab. Zero round-trips.
Each tool lives inline. Click to expand, work, copy. Nothing you paste ever leaves your browser. One-time ₹500 payment unlocks everything.
GitHub Recon
1,500+ code, issue, and repo queries. Switch search type without rewriting.
Sitemap Inspector
Parse XML sitemaps and robots files into a tree, search, export.
0 URLs
Browsers block cross-origin reads of arbitrary domains. Most fetches will fail with a CORS error — this is a browser security control, not a tool bug. Use paste mode for reliability, or supply your own CORS proxy URL below if you operate one.
Encoder / Decoder
Live conversion across 25+ formats. Copy or swap with one click.
JWT Inspector
Decode, verify, forge, and study JSON Web Token attack patterns.
Header
Payload
Signature
Saved secrets live in your browser's localStorage. Nothing is sent to any server.
Educational use only. The lab demonstrates published JWT vulnerabilities (RFC 8725 §2). Do not run these against systems you do not own or are not authorized to test.
Cookie Analyzer
Parse Set-Cookie headers, score flags, detect JWTs & PII.
SEO & Keyword Audit
Holistic on-page audit. Score, prioritized fixes, density, schema.
Cross-origin URL fetches are CORS-blocked in browsers. Provide a proxy you operate, or save the page and use paste mode.
Workflow & Notes
Recent tools, locally saved JWT secrets, recon checklist.
Recently used
Saved JWT secrets (local-only)
Recon checklist
- Confirm scope & written authorization before any active testing.
- Run Google + GitHub dorks against the apex and discovered subdomains.
- Pull
robots.txt,sitemap.xml,.well-known/security.txt. - Inspect every JWT and Set-Cookie header in scope; record flag posture.
- Audit the marketing site for accidental subdomain leaks & structured-data slips.
- Document every finding with reproduction steps and a clear impact statement.
Hash Identifier & Hasher
Identify common hash formats and compute MD5/SHA family digests locally.
// awaiting input…
// digests will appear here…
IP / CIDR Calculator
Network, broadcast, mask, host range, and reverse-DNS for any IPv4 + CIDR.
// IPv4 only. RFC 4632 CIDR semantics.
Password Strength Meter
Entropy estimate (bits), search space, crack time, common-pattern penalties.
// strength report appears here…
Crack-time estimates are heuristic. They assume offline, salted hashing at attacker GPU rates of 10⁹–10¹² guesses/sec depending on class.
HTTP Security Header Analyzer
Paste raw response headers. Get a 0–100 score and a prioritized fix list.
Regex Tester
Build, test, and debug regular expressions with live match highlighting.
Enter a pattern
Common patterns
Cron Expression Builder
Build cron expressions with visual controls and next-run preview.
0 * * * *
Presets
Next 5 runs
Color Converter
Convert between HEX, RGB, and HSL with a live preview.
Diff Tool
Compare two text blocks side-by-side with additions and deletions highlighted.
Prompt Token Counter
Estimate token counts, character length, and API cost for major LLMs.
Nmap Command Builder
Generate nmap scan commands for authorized security assessments.
Educational use only. Only scan systems you own or are explicitly authorized to test.
nmap -sS
Port Reference
Searchable database of common ports, services, and risk levels.
0 ports
Hash Cracking Reference
Map hash types to hashcat modes, john formats, and recommended wordlists.
Identifies hash type and generates hashcat/john commands. Use only on hashes you have authorization to crack.
A predictable recon loop.
Start broad with dorks. Narrow with sitemap and SEO surface analysis. Triage findings through JWT and cookie analyzers. Decode anything strange.
01 · Discover
Surface mapping
Run Google + GitHub dorks. Parse the sitemap. Note every subdomain, parameter, and exposed file.
02 · Inspect
Auth surface
Decode every JWT in flight. Score every Set-Cookie. Look for misconfigured SameSite, missing Secure, weak secrets.
03 · Decode
Format archaeology
Strange tokens? Encoded blobs? The encoder/decoder covers Base{16…85}, hex, ROT, hashes, HMAC, JSON→YAML→XML.
Security research, refined.
Built in Karnataka, India — for a global community of researchers who believe serious security work deserves serious tools. Every byte processes on your machine. There is no server, no log, no leak.
3,000+
Built-in Google & GitHub dorks, categorised and expandable
12
Integrated precision tools covering the full recon lifecycle
0
Bytes transmitted — pure client-side processing, zero telemetry
6
Atmospheric themes to match the mood and the mission
Get Full Access
Unlock 20 professional
Unlock 20 professional
security tools.
One-time payment. Lifetime access. No subscriptions, no data harvesting, no hidden fees. All processing stays in your browser — zero data leaves your machine.
One-Time Purchase
₹500
All 20 Tools · Lifetime Access
UPI ID: 7795577535@ybl
Scan & pay with Google Pay · PhonePe · Paytm · BHIM
After payment, enter your UPI Transaction ID to unlock instantly.
No refunds once payment is made.
Payment goes directly to development, hosting, and building new tools for the community.
Privacy Policy
Last updated:
1. No data collection
Hackerrecon is delivered as a single, static HTML page. All processing — dork generation, JWT decoding, cookie analysis, sitemap parsing, SEO scoring, encoding/decoding — happens entirely inside your browser. No domain, token, cookie, or HTML you paste is transmitted to any Hackerrecon server. There is no Hackerrecon server.
2. Local storage
The site uses your browser's localStorage to store non-sensitive preferences (theme, recently opened tools), any JWT secrets you explicitly choose to save, and your payment verification status. Saved secrets and payment status are stored on your device and are not synchronised, backed up, or transmitted.
3. Third-party assets
The page loads typography from Google Fonts, icons and syntax highlighting from jsDelivr, and a JWT crypto library from jsDelivr. These providers may log standard HTTP request metadata for the purpose of serving those assets. Hackerrecon does not control or receive that data.
4. Outbound search links
Buttons such as "Open in Google" or "Open on GitHub" construct a search URL and open it in a new tab. Once you click such a link you are interacting directly with that third party and their privacy policy applies.
5. Cookies
This site sets no cookies of its own.
6. Children
This site is not directed at minors and is intended for security professionals and adult learners.
7. Changes
This policy may be updated. The "Last updated" date above reflects the current version.
8. Contact
Privacy questions or abuse / DMCA reports: hackerrecon@protonmail.com.
Legal Disclaimer & Acceptable Use
Educational purpose only
Hackerrecon is provided exclusively for authorized security research, bug bounty engagements within published program rules, capture-the-flag and lab exercises, and academic study. It is a reference and convenience tool — every operator and query it produces is publicly documented.
User responsibility
You are solely responsible for ensuring you have explicit, written authorization to test any target system. Unauthorized access to or interference with computer systems is illegal under the Computer Fraud and Abuse Act (US), the Computer Misuse Act 1990 (UK), the Information Technology Act 2000 (India), and equivalent statutes elsewhere.
No warranty
The Service is provided "AS IS" and "AS AVAILABLE," without warranty of any kind, express or implied, including warranties of merchantability, fitness for a particular purpose, accuracy, completeness, non-infringement, or uninterrupted operation.
Limitation of liability
To the maximum extent permitted by law, the operators of Hackerrecon disclaim any and all liability for direct, indirect, incidental, consequential, special, exemplary, or punitive damages arising out of or relating to your use of the Service.
Indemnification
You agree to defend, indemnify, and hold harmless the operators of Hackerrecon, their affiliates, and their respective officers, contractors, and agents from any claims, damages, obligations, losses, liabilities, costs, or expenses arising from or related to your use of the Service.
Acceptable use
You agree not to use the Service to: (a) test or interact with systems you do not own or have explicit, written permission to assess; (b) evade legal responsibility; (c) harass, threaten, or harm others; (d) circumvent security controls; (e) violate any applicable law or regulation.
No data collection
All processing occurs locally in your browser. No inputs are transmitted to any Hackerrecon server.
Reporting abuse
To report abuse or submit a DMCA notice: hackerrecon@protonmail.com.
Governing law
These terms are governed by the laws of India. Exclusive jurisdiction and venue lie in the courts located in India.