Arsenly
Tools
Recon & Discovery16 tools Web Security Audit10 tools Exploitation & OOB3 tools Payloads & Wordlists4 tools Cryptography & Generators3 tools Encoders & Converters5 tools Reference & Reports4 tools
Browse the full catalogue Open /explore →
Free Tools
Recon & Discovery
SiteMapper ProTurn a URL list into 4 views: hierarchical host/path tree, sortable fl… URL & Endpoint ExtractorMine URLs, JS endpoints, domains and parameters from pasted source cod… CIDR / IP CalculatorIPv4 and IPv6 subnet math. Expand CIDRs, parse ranges and netmasks, ag…
Web Security Audit
Cookie / JWT AuditorAudit cookie flags (Secure, HttpOnly, SameSite, __Host- / __Secure- pr… OpenAPI / Swagger AnalyzerPaste or drop an OpenAPI 3 / Swagger 2 spec and map its attack surface…
Cryptography & Generators
Hash ToolkitGenerate (MD5, NTLM, SHA) and identify 60+ hash types with ranked cand… Test Data GeneratorRealistic-looking test data across 22 countries: names, emails, phone … Code / Password / Token GeneratorCustom-charset strings (1-512 chars, up to 5000 at a time), passwords …
Encoders & Converters
Encoder / Decoder4-tab workbench: 20+ encodings (URL, double-URL, percent-all, Base64, … HTTP Request ConverterConvert HTTP requests between 6 formats: Raw HTTP (Burp), curl, fetch(… JSON WorkbenchFormat, validate (with line / col error), minify, sort keys, unescape … Text Suite7-tab text workbench: regex find/replace, sort/dedupe/sample, keep-dro… Text Comparer4-tab diff workbench: true LCS line / word / char diff, side-by-side, …
See all 13 free tools on /explore →
Pricing
Resources
ChangelogWhat's shipped lately API DocsAutomate scans from your CLI About XowiaLabsWho's behind this ContactBug reports, ideas, just say hi Terms & PrivacyAcceptable-use policy + privacy
Sign in Get started

Terms, Privacy & Responsible Use

Last updated August 5, 2026

Plain-English summary: use Arsenly only against systems you're authorised to test. We process the data you give us (account info, scan history) and never sell it. India's DPDP Act applies. Full text below.

Operator

Arsenly is operated by XowiaLabs, a subsidiary of Xowia Technologies, an information security company incorporated in India. References to "we", "our" or "us" in this document refer to XowiaLabs. Governing law: India. Disputes are subject to the exclusive jurisdiction of competent courts in India.

1. Acceptable & authorized use

Arsenly provides offensive-security tooling intended only for systems you own or for which you hold explicit, written authorization (e.g. an in-scope bug-bounty program or a signed engagement). Using these tools against systems without authorization may be illegal in your jurisdiction and is strictly prohibited.

2. Your responsibility

You are solely responsible for how you use the tools and for ensuring your testing is lawful and authorized. Arsenly ships scope controls and rate limits to assist, but does not verify authorization on your behalf. We accept no liability for misuse or for any damage resulting from your activity.

3. Prohibited activity

No unauthorized scanning, exploitation, DoS, scanning of critical infrastructure, or use of the platform to attack Arsenly or other users. We may suspend accounts for abuse.

4. Data we store (DPDP Act, 2023)

XowiaLabs is the data fiduciary for Arsenly. We process account details (name, email, password hash), tool usage and metered scan results in your private history, projects you create and audit/security logs. We do not sell your data and we do not use it for advertising. Under India's Digital Personal Data Protection Act, 2023 you have the right to access, correct, erase and export your personal data, and to withdraw consent - all available from Settings → Your data / Danger zone in the dashboard. Grievances may also be raised via the contact form; XowiaLabs acts as the Grievance Officer.

5. Cookies & sessions

We use a single first-party session cookie for authentication. No third-party advertising or tracking cookies.

6. Payments

If billing is enabled, payments are handled by third-party processors (Razorpay/Stripe). We never receive or store card data.

7. Security disclosure

Found a vulnerability in Arsenly itself? Please report it privately via our contact form before any public disclosure. We appreciate good-faith research.

8. Changes

We may update these terms; continued use constitutes acceptance. Material changes will be reflected by the date above.