An independent, white-hat scanning service
Scan.now exists to make security findings understandable. It is built and run by a small team, funded without advertising, and designed so that using it costs you nothing in privacy.
What Scan.now is
Scan.now is a set of free, read-only security tools for three things people worry about: The website they run, the browser they use and the file they just downloaded. Every tool produces a report where each line links to a page explaining what was tested, why it matters and how to fix it. The guides and the checks reference are the heart of the site; the scanners are how you find out which parts apply to you.
Who runs it
Scan.now is operated by the Scan.now Security Desk, a small group of web developers and security practitioners who spent years reading scanner output that nobody around them could interpret. The bylines on guides are the desk's, not invented individuals, because every guide is written, checked and revised collaboratively. Corrections are welcome through the contact form and are logged on the editorial policy page.
How it is funded
There is no advertising on Scan.now, no affiliate links and no sponsored placements. Nothing on this site is ranked, recommended or scored because someone paid for it, and no scanner result is influenced by money.
What is free
Every scanner, every one of the 179 checks, every explanation and every guide, for scans of up to 25 pages. No card, no trial clock, and a daily allowance of site scans that most people never reach. Scanning needs no account; reading a long report all the way down needs a free one, which is one click and an email address. That is enough to find the patterns a site’s templates repeat, which is what most people need.
What is paid
A paid plan exists for the one thing a sample cannot answer: Auditing a whole site rather than the first 25 pages of it. A crawl costs bandwidth twice, ours and yours, so the large ones are charged for and the small ones stay free, with a daily allowance rather than a bill. Checkout is not connected yet; the prices on that page are what the plans will cost.
What this buys and what it does not
- It does not buy a better grade. The same checks run at the same severities whether you have paid or not.
- It does not buy privacy you would otherwise lack. Free and paid scans are stored, and deleted, on identical terms.
- It buys scale: more pages per crawl, every scanner in one run, and a report you can download and hand to someone else.
If the funding model changes again, the change will be described on this page before it takes effect, as this one was.
Why passive
A scanner that sends attack payloads to a site you do not own is, legally and ethically, an attack. Scan.now only performs actions any visitor's browser already performs: Fetching a page, opening a TLS connection, resolving DNS, and requesting a short fixed list of paths that should never be public. It never guesses credentials, submits forms or attempts exploitation. The full list of what it does and does not do is on the methodology page.
What we keep
The short version, with the full detail in the privacy policy:
- Uploaded files: held in memory for the length of the scan, never written to disk.
- Scan reports: 30 days at an unguessable link, served
noindex, then deleted. - Browser checks: hashes of signals, never the signals themselves.
- What we never keep: the passwords you test, the contents of your files, and the pages we crawl.
Uploaded files are analysed in memory and discarded. We keep a file's SHA-256 hash and the verdict so a known-bad file can be recognised instantly. Website reports are stored for 30 days at an unguessable link, excluded from search engines, and then deleted. The browser check sends hashes of signals, never the signals themselves. The privacy policy lists everything.