GuardPad vs Hammer

Scan any URL and get an instant A+ to F security grade with actionable fixes — right from your iPhone or iPad. GuardPad analyzes 11 HTTP security headers, SSL/TLS certificates (including post-quantum readiness), cookies, redirect chains, DNS records, email security, and infrastructure fingerprints in seconds. The most comprehensive mobile security scanner — and the only one with widgets, Siri integration, and a Share Extension. Try every feature free for 3 days. No account required. No data collected. NATIVE iOS, EVERYWHERE YOU NEED IT • Share Extension — scan any URL straight from Safari or any browser • Siri & Shortcuts — "Hey Siri, scan example.com with GuardPad" • Home Screen & Lock Screen widgets for pinned domains • Control Center toggle for instant re-scans (iOS 18+) • Universal app with optimized iPad layouts FREE FEATURES • 11 graded security headers (HSTS, CSP, COOP, COEP, CORP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, X-XSS-Protection, Server) • Email security analysis — SPF, DMARC, DKIM, MTA-STS, and BIMI graded with detailed findings • Cookie security analysis (Secure, HttpOnly, SameSite, __Host- prefix) • CSP depth analysis (nonce, strict-dynamic, Report-Only) • SSL/TLS certificate inspection with cipher suite details • TLS depth analysis with post-quantum (X25519MLKEM768) detection • Redirect chain visualization with quality grading • Deprecated header detection (HPKP, Expect-CT, Feature-Policy) • OWASP Top 10:2025 compliance mapping • .well-known directory scanner (security.txt RFC 9116 and more) • WAF/CDN fingerprinting (Cloudflare, CloudFront, Akamai, Fastly, and 10 more) • Subdomain discovery via DNS-over-HTTPS • API endpoint intelligence (rate limits, exposed docs, GraphQL introspection) • PCI DSS 4.0 readiness assessment • Comparative context — percentile ranking against your scan history • Quick Fix mode — see your highest-impact issues first • Actionable WHAT/WHY/FIX diagnostics for every finding • Domain-grouped scan history • Works offline for reviewing past results PRO FEATURES • Continuous monitoring — scheduled background re-scans with change-only notifications (unlimited domains with Yearly, 1 domain with Lifetime) • Certificate expiry alerts (30/14/7/3/1 days) • Grade trend charts and security posture dashboard • Batch scanning — up to 50 URLs at once with aggregate report • Shareable security grade card and shields.io-style badge for READMEs • iPad side-by-side scan comparison • Server-specific fix code snippets for nginx, Apache, Express.js, and Caddy • CORS configuration tester • DNS record lookup with DNSSEC, CAA, and full record types (A, AAAA, MX, CNAME, TXT, NS, SOA) • PDF and Markdown export • Full certificate chain inspection Built for developers, security engineers, and IT teams who ship secure web applications. Whether you maintain nginx, Apache, Express.js, or Caddy, GuardPad gives you the tools to verify your configuration matches OWASP, PCI DSS 4.0, and modern security baselines. PRIVACY-FIRST No account. No analytics SDKs. No tracking. Zero external dependencies. All analysis happens on your device. Scan results stay in SwiftData on your device only. See Privacy Policy in Settings. GuardPad is a developer tool for auditing security configuration of web servers you own or have permission to scan. Terms of Use (EULA): https://www.apple.com/legal/internet-services/itunes/dev/stdeula/

Hammer is a professional HTTP and HTTPS debugging toolkit for developers, QA engineers, mobile teams, and technical users who need a clear way to inspect, analyze, and troubleshoot network traffic on iPhone and iPad. Whether you are testing an API, debugging a mobile app, checking request headers, reviewing response data, or exporting sessions for deeper analysis, Hammer helps you understand what is happening between your app, website, and backend services. Designed for local-first network inspection, Hammer keeps captured data on your device by default. Requests, responses, headers, cookies, and session history remain local unless you choose to export or share them. How Hammer Works: Hammer uses Apple's public Network Extension framework and a Packet Tunnel Provider to enable on-device traffic capture. When you tap Start and approve the iOS system configuration prompt, Hammer creates a local Packet Tunnel. Traffic included in the active capture session is routed through Hammer's local proxy process on the same device, where requests and responses can be inspected and displayed. The Packet Tunnel does not connect your traffic to a remote VPN server. Hammer does not provide anonymous browsing, change your virtual location, or hide your public IP address. iOS displays VPN-related permission text and may show a VPN status indicator because Apple manages Packet Tunnel Provider configurations through its VPN configuration infrastructure. Key Features: Live Traffic Capture Capture HTTP and HTTPS requests in real time. Review method, host, path, status code, protocol, timing, size, and request details in a clean debugging interface. Detailed Request Inspector Inspect URL parameters, request and response headers, message bodies, status codes, timing metrics, and content types. HTTPS Debugging Use optional certificate-based HTTPS inspection in development, testing, or other authorized environments. Certificate installation and trust are controlled by the user through iOS Settings. Request History Keep capture sessions organized locally so you can revisit traffic, compare results, and investigate issues after testing. Rules and Filters Manage rules for bypassing hosts, blocking traffic, rewriting requests, mapping responses, and controlling traffic during debugging. HAR Export Export captured sessions as HAR files for desktop analysis, bug reports, team collaboration, or long-term debugging records. Local Proxy Workflow Use Hammer's on-device Packet Tunnel and local proxy workflow to inspect traffic from apps, browsers, and services you are authorized to analyze. Clean Debugging Interface Work with readable request lists, structured detail views, protocol statistics, favorites, and practical tools for repeated debugging. Local-First Privacy Captured network content is processed and stored locally by default. Hammer does not require an account, and the Packet Tunnel does not upload captured traffic to a remote VPN server. Data leaves your device only when you explicitly export, share, or submit it through a user-initiated action. Hammer is useful for: • Debugging mobile app API requests • Inspecting HTTP and HTTPS traffic • Reviewing headers, cookies, and response bodies • Testing backend services and REST APIs • Checking status codes, redirects, and timing • Exporting HAR files for issue reports • Managing traffic rules during development • Investigating network behavior during QA testing Hammer is intended for legitimate development, testing, and debugging workflows. Use it only with apps, websites, services, and network traffic that you own or have permission to inspect.