How to use HSTS policy analyser
Parse Strict-Transport-Security and inspect max-age, includeSubDomains and preload intent. The check runs when you submit the form. Its inputs are processed in this browser.
How the check works
The analyser reads a pasted header value and checks the max-age directive, duplicate directives and the optional subdomain and preload tokens.
The Overview tab explains the findings. Measured data lets you search individual fields and values, while JSON report shows the complete export. Export JSON to retain a baseline, or print the findings for your own records. Review the report before sharing it: browser characteristics, token claims, and file names can reveal information about your setup.
Read the result in context
A max-age of zero removes a dynamically learned policy. includeSubDomains expands its scope. The preload token expresses intent; it does not establish list membership.
Understand the limits
Browsers process HSTS over secure transport. This local parser does not make a request or query a preload list.
Common questions
Where is the input processed?
In this browser tab. This tool does not submit its input to the site server or a third-party service.
What should I keep with a result?
Record the selected options, browser and time. Review exported values before sharing them. Generated passwords, tokens and HMAC secret keys are excluded from report exports.