Accepts raw domains (example.com) or full URLs — protocol prefixes are stripped automatically.
Instantly verify whether any domain serves HTTPS with an active TLS connection using BunchTool's free HTTPS Checker. Enter any domain name, and the browser issues a no-cors Fetch API probe directly to https:// on port 443 — distinguishing secure TLS responses, CORS-blocked HTTPS, and insecure plain HTTP, all without routing through any backend server.
no-cors Fetch API probe to https://{domain} to verify TLS handshake reachabilityType any domain name (e.g. example.com) or full URL into the input field. Protocol prefixes like http:// or https:// are stripped automatically before the probe.
Your browser issues a no-cors fetch to https://{domain}. If the TLS handshake succeeds — whether the response is received or CORS-blocked — the domain is confirmed HTTPS-active.
View the Security Rating, Protocol Connection label, and a plain-English status description explaining exactly what the probe result means for the domain's TLS configuration.
Uses the browser's native fetch(url, { mode: 'no-cors' }) to probe port 443 directly — a TLS handshake must complete for the browser to receive even a CORS rejection, confirming HTTPS.
If you enter a URL starting with http://, the tool explicitly flags the domain as insecure — data in transit is unencrypted and susceptible to MITM interception and packet sniffing.
Unlike traditional SSL checkers that proxy through a server, this tool's fetch request goes directly from your browser to the target. BunchTool never sees the domain you are checking.
mode: 'no-cors' directly from your browser to https://{domain}. If the fetch succeeds or is CORS-blocked (which still implies a TLS handshake occurred), the domain is confirmed HTTPS-active. No BunchTool server is involved.Strict-Transport-Security) are only visible from HTTP response headers, which are blocked from JavaScript in no-cors mode. This tool confirms TLS reachability only, not HSTS policy configuration.HTTPS (HyperText Transfer Protocol Secure) is HTTP layered over TLS (Transport Layer Security). During a TLS handshake, the browser and server negotiate a cipher suite, the server presents its X.509 certificate (verified against trusted Certificate Authorities), and a session key is derived via ECDHE or RSA key exchange. All subsequent data is encrypted — preventing network eavesdroppers from reading passwords, tokens, or page content in transit.
The no-cors Fetch probe technique works as follows: fetch('https://example.com', { mode: 'no-cors' }) instructs the browser to attempt the request but block JavaScript from reading the response. If the TLS handshake on port 443 succeeds, the browser either resolves the promise (opaque response) or throws a CORS error — both outcomes confirm the server accepted a TLS connection. If port 443 is unreachable or TLS fails entirely, the promise rejects with a network error.
HTTP vs HTTPS security gap: On a plain HTTP connection, every byte is transmitted in cleartext. Any router, ISP, or network proxy between the user and server can intercept, read, or modify the content — a classic man-in-the-middle (MITM) attack. Modern browsers flag HTTP pages with a "Not Secure" warning and Chrome blocks mixed HTTP content on HTTPS pages. Google Search also applies a ranking boost to HTTPS-served domains.