Bookmarks

Cool Websites — October 18, 2026

Security & Privacy

CreepJS

CreepJS doesn't just show your browser's fingerprint, it flags where your own signals contradict each other: a spoofed timezone next to a font list that gives away your real one, a canvas hash that doesn't match the claimed GPU. That's the same contradiction-hunting logic anti-fraud systems use, so it's a solid way to see how "fake" your hardened setup actually looks from the other side.

crypt.fyi

crypt.fyi runs on the same idea as Onetime Secret, updated for 2026: post-quantum encryption (ML-KEM), a cap on how many times a link can be opened, and bot detection so a link-preview crawler can't burn your secret before the real recipient reads it.

ExifCleaner

Drag a photo or PDF onto ExifCleaner and it strips every trace of metadata, GPS coordinates included, then shows a before-and-after diff of exactly what it pulled out. No network calls, no telemetry, and it's open source if you want to check that claim yourself.

3D Modeling & Printing

OwlCAD

OwlCAD runs a full parametric CAD editor in your browser with no install and no account, and its AI mode turns a written description into solid geometry you can still edit by hand, not a mesh blob you're stuck with.

chili3d

chili3d compiles the OpenCascade CAD kernel to WebAssembly, which means real STEP and IGES-grade solid modeling, sketches, constraints, boolean operations, running in a browser tab instead of a desktop install. Almost 5,000 GitHub stars and still shipping regular releases.

BOSL2

BOSL2 is the OpenSCAD library most people switch to once they get tired of hand-rolling primitives. It adds an attachment system for snapping parts together by face or edge, plus rounding, gears, and threading that vanilla OpenSCAD never shipped.

PrintPal Mesh Repair & Simplifier

PrintPal's mesh repair tool handles the unglamorous damage a bad 3D scan leaves behind: holes, flipped normals, non-manifold edges. It runs in the browser, so your file never leaves your machine.

OSINT & Investigation

Bellingcat ShadowFinder

Give ShadowFinder an object's height, its shadow length, and a timestamp, and it works out every point on Earth where that shadow geometry is physically possible. A "where was this photo taken" question that started as a global search ends as a shortlist of a few countries.

GeoWiFi

GeoWiFi takes a WiFi network's MAC address or name and resolves it to real coordinates using public WiFi-geolocation databases. It only queries those databases, it never probes the network itself, and it can export the result as an interactive map.

InVID-WeVerify

InVID-WeVerify is a browser extension built for people who verify video and photos for a living: it fragments a clip into keyframes for reverse-image search, pulls embedded metadata, and runs forensic filters that flag tampering. Five tools in one toolbar button.

Cyber / Hacking Tools

CTFlearn

CTFlearn's challenges don't disappear after a 48-hour event. Hundreds of crypto, web, forensics, and OSINT puzzles stay solvable indefinitely, which makes it better for steady practice than for competition.

pwnable.kr

pwnable.kr hands you SSH access to a remote box, the source code, and a bug to exploit for the flag. It's been teaching buffer overflows and format-string attacks since well before pwn.college existed, and plenty of newer platforms still point back to it.

MalwareBazaar

MalwareBazaar is abuse.ch's public archive of real malware samples, searchable by hash or tag, with a free API. ANY.RUN and Triage give you a sandbox report about a sample; this gives you the actual binary the report is describing.

IT & Sysadmin Tools

DNSViz

DNSViz draws a domain's entire DNSSEC chain as a graph, so you can see exactly which zone or key broke validation. That's something dig's text output makes genuinely hard to spot.

ShieldsUP!

ShieldsUP! fires an external port scan at your current public IP from Gibson Research's own servers and reports which ports look open, closed, or stealthed from outside your firewall. No install required, and the site says it keeps none of the scan data.

Mail-Tester

Send a message to the address Mail-Tester generates and it scores how spammy that email looks: SPF, DKIM, and DMARC alignment, blacklist status, HTML issues. Usually faster than guessing why your transactional mail keeps landing in spam.

Windows Software

WSCC

WSCC is one portable shell that auto-downloads and keeps updated the eighty-some individual .exe files that make up Sysinternals and NirSoft, so you stop hunting for each one separately.

NanaZip

NanaZip forks 7-Zip for Windows 11: native right-click menu integration, dark mode, and codecs like Zstandard and Brotli that the original never added.

OpenRGB

OpenRGB replaces the separate RGB app your motherboard, RAM, GPU, and keyboard each want installed with one controller that talks to the hardware directly. It also ships a network SDK, so a game or music visualizer can drive the lighting itself.

Open Source Software

Pinchflat

Pinchflat is a self-hosted YouTube manager built on yt-dlp: set rules per channel and it auto-downloads new uploads into a Plex-ready library. It can also output a podcast RSS feed, so you can subscribe to a channel's audio in any normal podcast app.

Dawarich

Dawarich stands in for Google Timeline once you self-host it. Feed it GPS pings from OwnTracks or a Timeline export and it maps your trips and tracks distance traveled. Run Immich alongside it and it cross-references your photos onto the map automatically.

Homepage

Homepage is a YAML-configured dashboard for a homelab that reads Docker labels to find your running containers and show live widgets for them, without exposing any of those services' APIs to the outside world.

WhoDB

WhoDB is one admin UI for Postgres, MySQL, MongoDB, Redis, and five other databases, with a spreadsheet-style editor and an optional AI panel that turns a plain-English question into a real query.

Productivity & Collaboration

SwissTransfer

SwissTransfer sends files up to 50GB through a link, no account needed. Everything sits encrypted in Swiss data centers and deletes itself after 30 days.

Heptabase

Heptabase swaps linear notes for an infinite whiteboard of connected cards, built for research where you need to see how fifteen sources relate to each other, not just list them one after another.

Sunsama

Sunsama pulls your tasks out of Gmail, Slack, Asana, and a dozen other tools into one list, then makes you timebox each one onto today's calendar before it'll let the day count as planned.

Kinopio

Kinopio is a free-form canvas for mind maps and moodboards. Click anywhere to drop a card, draw a line between two ideas, select a cluster to edit together. Free up to 100 cards, no account required.

Travel

Great Circle Mapper

Great Circle Mapper plots the shortest flight path between any two airports and calculates the real distance, which is exactly what you need before guessing how many Avios or Aeroplan miles a booking will cost. Those programs price by distance flown, not cash fare.

seats.aero

seats.aero searches live award-seat availability across twenty-plus airline loyalty programs at once, so you stop opening United's site, then American's, then Delta's, one at a time.

Sherpa

Sherpa pulls current visa, entry, and health requirements for 220+ destinations based on your actual passport and travel dates, then lets you file the eVisa or ETA on the spot for dozens of those countries.

CozyCozy

CozyCozy meta-searches more than twenty booking sites at once, including the unusual listings, treehouses, yurts, houseboats, that Airbnb's own search tends to bury.

Fun / Weird Internet

Silk

Drag your cursor across Silk's canvas and it mirrors the stroke into a symmetrical, glowing pattern in real time. No skill involved. Every motion looks intentional.

Find the Invisible Cow

There's no cow on screen in Find the Invisible Cow, just a sound that gets louder as your cursor nears it. You click when you think you've triangulated the thing. Find enough and it unlocks new invisible animals to hunt.

Smash the Walls

Click a colored rectangle on Smash the Walls and it splits into two smaller ones. Click those, they split again. Over 500 million clicks logged, and that's genuinely the entire site.

Quick, Draw!

Google's neural net tries to guess what you're sketching on Quick, Draw!, twenty seconds a round, six rounds total. Watching it blurt out wrong answers before nailing a terrible stick figure is funnier than it has any right to be. Your doodles become training data for the next version. --- *35 sites this week. Found something broken or have a site to suggest? Reply to the email.*