Real-Time IP Lookup
What's My IP Address? Percival Found It.
Percival swoops through the internet's dark corners so you don't have to. Here's what the web can see about your connection right now.
Your Public IP Address
Percival couldn't reach the lookup service. Check your connection and hit refresh.
What Else Percival Found
Your connection details
Your Connection
Speed test
A real download/upload speed test using Cloudflare's public speed-test network — the same infrastructure behind speed.cloudflare.com.
Uses real data transfer to measure live speeds — worth keeping in mind on a metered or capped connection.
Your Connection
Latency checker
Percival times a round trip to a few well-known DNS resolvers directly from your browser — an HTTP round-trip, not a true ICMP ping, but a solid read on how snappy your connection is right now. Add your own site below to test it alongside them.
Measures the time to complete a full HTTPS request-response round trip (DNS + TLS + response), not a raw ICMP ping — browsers can't send ICMP. Real latency can vary between runs. A custom site is tested the same way as the built-in resolvers; some sites block this kind of cross-origin timing probe outright, which will show as "Unreachable" even if the site is actually up.
All-In-One
Master lookup
Enter an IP address or a hostname, pick which tools to run against it, and Percival pulls them all together into one downloadable report.
Detected — — tools that don't apply to this are grayed out:
Domain & IP Lookups
DNS lookup
Percival digs up the DNS records for any domain — A, AAAA, MX, NS, and TXT.
| Type | Value |
|---|
Domain & IP Lookups
Domain & IP registration lookup
Percival digs up registrar, registration dates, and ownership info for a domain or IP — via RDAP, the modern, standardized successor to WHOIS.
Powered by RDAP, the IETF-standardized JSON API that's replacing WHOIS — works for domains and IPs across all five regional internet registries (ARIN, RIPE NCC, APNIC, LACNIC, AFRINIC).
Domain & IP Lookups
CAA record checker
CAA records say which Certificate Authorities are allowed to issue SSL certificates for a domain — Percival checks what's actually published.
| Tag | Authorized For | Flags |
|---|
No CAA records isn't an error — it means the domain hasn't restricted issuance, so any publicly trusted CA can issue a certificate for it. `issue` restricts normal certs, `issuewild` restricts wildcard certs, and `iodef` is just a contact address for reporting policy violations.
Domain & IP Lookups
IP geolocation lookup
The hero card up top only shows your IP's location — this looks up city, ISP, and timezone for any IP address.
Uses the same free ipapi.co lookup as the connection details card up top, so it shares that ~1,000-lookups/day quota. IP geolocation is inherently approximate — it's usually accurate to the city or ISP level, not your exact address.
Domain & IP Lookups
Is it down?
Percival tries to reach any site directly from your browser to see if it responds.
—
—
This only checks whether your device and network can reach the site — not whether it's down for everyone, and not whether the page itself loads correctly (a site that responds with an error still counts as "reachable" here). Some sites also block this kind of automated check, which can show as unreachable even when the site is fine.
Network Config
Subnet calculator
Enter an IPv4 address with a CIDR prefix and Percival will work out the rest — no lookups, no network calls, just math.
Network Config
CIDR / subnet mask converter
Enter a CIDR prefix or a dotted subnet mask and Percival converts it to the other — just the mask math, no IP address required.
Network Config
Seconds ↔ minutes ↔ hours converter
Enter a duration in any unit — handy for DNS TTLs, cache expiry, session timeouts, cron intervals, and VPN/IPsec tunnel lifetimes.
Also useful for VPN tunnel configs — IPsec Phase 1/Phase 2 SA lifetimes are typically set in seconds, and 3600 (1 hour) is a common default rekey interval.
Network Config
Preshared key generator
Generates a cryptographically random key for IPsec, WireGuard, or VPN tunnel configs — using your browser's secure random number generator, not a predictable one.
—
Generated with crypto.getRandomValues() — a cryptographically secure random source, not Math.random(). Nothing generated here is sent anywhere; it only ever exists in your browser.
Network Config
Cron expression explainer
Paste a standard 5-field cron expression and Percival explains what it means in plain English, plus the next few times it would actually run.
—
Standard 5-field cron syntax (minute, hour, day-of-month, month, day-of-week) — supports *, ranges (1-5), steps (*/15), and lists (1,15,30). Next-run times are computed against your device's local clock and time zone.
Network Config
IPv6 address tools
Expand or compress an IPv6 address, or work out the network range for a CIDR block — the IPv6 companion to the subnet calculator above.
Pure client-side bitwise math using JavaScript's BigInt (IPv6's 128-bit address space is too big for regular numbers) — no network call, works offline.
Email Deliverability
Email security check
Percival checks whether a domain has SPF and DMARC set up — the two records mail servers use to fight spoofing.
SPF
—Sender Policy Framework — lists which mail servers are allowed to send email for this domain.
—
DMARC
—Tells receiving mail servers what to do with messages that fail SPF/DKIM checks.
—
DKIM isn't shown here — its record lives at a provider-specific "selector" that isn't discoverable from public DNS alone. Use the DKIM checker below, which tries common selectors automatically.
Email Deliverability
DKIM record checker
DKIM records live at a provider-specific "selector" that can't be discovered from public DNS alone — so Percival tries a handful of common selectors automatically, or checks the exact one you give it.
| Selector | Record |
|---|
Common selectors tried automatically: google, selector1, selector2, k1, default, mail, dkim. If your provider uses a different one, enter it directly — DKIM selectors genuinely can't be guessed from DNS alone.
Email Deliverability
Email header analyzer
Paste the raw headers from any email (usually "View Source" or "Show Original" in your mail client) and Percival pulls out the authentication results, the server hop chain, and any From/Return-Path mismatch — entirely in your browser.
Authentication Results
From / Return-Path
—
Received Hop Chain
| Hop | From → By | Delay |
|---|
Everything here is read straight from the headers you paste — nothing is sent anywhere. "Authentication Results" reflects whatever the receiving mail server already decided, not a live re-check by Percival.
Email Deliverability
Reverse DNS / PTR lookup
A mail server IP without a matching PTR record is one of the most common reasons legitimate email gets flagged as spam. Percival checks the PTR record, then confirms it points back to the same IP.
"Forward-confirmed" means the PTR hostname's own A record resolves back to the exact same IP you looked up (FCrDNS) — the gold standard for mail server reputation.
Email Deliverability
Blacklist check
Percival checks whether an IP address, domain, or mail server is flagged on well-known spam/abuse blacklists — handy when mail from a server starts bouncing.
Checked against 14 blacklists. Enter a domain or hostname instead of an IP and Percival resolves it first — mail server (MX) if it has one, otherwise the plain A record — then checks that IP. Spamhaus and SpamRATS aren't included — both fail to answer queries from public DNS resolvers like the one this tool uses, so they can't be checked reliably this way. SORBS is also left out; its DNSBL zone no longer appears to resolve.
Security
Password breach check
Checks a password against known data breaches — the password itself never leaves your browser.
Percival hashes the password locally in your browser (SHA-1) and sends only the first 5 characters of that hash to Have I Been Pwned's Pwned Passwords API — never the password, and never the full hash. This "k-anonymity" technique is the same one 1Password and Firefox Monitor use.
Security
Certificate transparency & subdomain finder
Searches public Certificate Transparency logs (via crt.sh) for every SSL/TLS certificate ever issued for a domain — and surfaces the subdomains hiding in them.
Most recent certificates:
| Common Name | Issuer | Valid From | Valid To |
|---|
Certificate Transparency logs are public by design — anyone can query them. This surfaces subdomains that were ever named on a certificate, including old or decommissioned ones, so treat results as historical, not a live map of what's currently running.
Security
Hash identifier
Paste a hash and Percival works out which algorithm(s) it could be — based on length and format, entirely in your browser.
This is a best guess from length and format alone — plenty of algorithms share the same output length (MD5 and NTLM are both 32 hex characters; SHA-256, SHA3-256, and BLAKE2s are all 64), so treat this as a shortlist, not a definitive answer.
Security
MAC address analyzer
Normalizes a MAC address and reads the two bits IEEE reserves in it — no vendor database needed, entirely in your browser.
The Individual/Group and Universal/Local bits are set by IEEE 802 convention, not looked up — a "Locally Administered" result usually means the address was set manually or by a hypervisor (common for VMs, containers, and randomized/private Wi-Fi addresses), not burned into hardware at the factory.
Dev & Security Utilities
JSON formatter & validator
Paste in JSON to pretty-print it, minify it, or just check whether it's valid — entirely in your browser.
Result
—
Pure client-side JSON.parse / JSON.stringify — nothing you paste here is ever sent anywhere.
Dev & Security Utilities
Base64 / URL encoder-decoder
Encode or decode text as Base64 or URL (percent) encoding — updates live as you type, entirely in your browser.
—
Dev & Security Utilities
Regex tester
Test a regular expression against sample text — matches highlight live as you type, entirely in your browser.
Dev & Security Utilities
Password & passphrase generator
Generates a random password or a diceware-style passphrase, using crypto.getRandomValues() — cryptographically secure, and it never leaves your browser.
—
—
Dev & Security Utilities
Timestamp converter
Convert between Unix timestamps and human-readable dates — handy for reading logs, certificate expiry, and JWT exp/iat claims.
Timestamp → Date
Date → Timestamp
Dev & Security Utilities
Hash generator
Type some text or pick a file — Percival computes MD5, SHA-1, SHA-256, and SHA-512 entirely in your browser. Nothing is uploaded anywhere.
| Algorithm | Hash | |
|---|---|---|
| MD5 | — | |
| SHA-1 | — | |
| SHA-256 | — | |
| SHA-512 | — |
Dev & Security Utilities
URL parser
Paste any URL and Percival breaks it down into protocol, host, path, and query parameters — handy for untangling long tracking or redirect links.
No query parameters.
Dev & Security Utilities
HTTP status code reference
Look up what an HTTP status code means, or browse the full list below.
—
—
Browse all status codes
| Code | Name | Category |
|---|
Dev & Security Utilities
JWT decoder
Paste a JSON Web Token and Percival decodes the header and payload — entirely in your browser, nothing sent anywhere.
Header
——
Payload
——
This only decodes the token — it does not and cannot verify the signature without the signing secret/key. A token that decodes cleanly is not necessarily authentic or untampered-with; never trust a decoded-but-unverified token for authorization decisions.
Dev & Security Utilities
User-agent string parser
Paste any User-Agent string — from a support ticket, a server log, wherever — and Percival breaks it down into browser, OS, and device type. Pre-filled with your own for a quick look.
Parsed with pattern-matching against common browser/OS signatures, not a full device database — unusual or spoofed User-Agent strings may not match cleanly.
Owl Fact
Loading a fact…