How IncogSay works
Two kinds of tool
In-browser tools ship their logic in the page. The calculators and the password entropy meter work this way: the value you type is read by JavaScript already running on your machine, the answer is computed there, and no request is made. Open the network tab and watch — there is nothing to see. They keep working offline once the page has loaded.
Edge tools need something only the public internet can answer: what does this domain's DNS say, what certificate does this host present, where does this redirect go. Those questions go to a worker running in a data centre near you. It performs the lookup, assembles the result in memory and returns it in the same response. Nothing is queued, filed or written to disk on the way through.
Every tool's own page says which of the two it is, so you always know before you type.
Email Suite — 11 tools
Audit and build the DNS records that decide whether your email is trusted — SPF, DKIM, DMARC, BIMI and MTA-STS — then score the whole posture.
Each check is a DNS query for a published record, then a parse. SPF means reading the v=spf1 TXT record and walking every include it references, counting lookups as it goes because the specification caps them at ten. DKIM means fetching selector._domainkey.yourdomain.com and decoding the public key. DMARC means reading _dmarc.yourdomain.com and reporting the policy and alignment mode. Nothing is sent to your mail server, and no credentials are ever requested — these are public records, readable by anyone, which is exactly why they work.
Link & URL — 10 tools
See where a link really goes before you click it: expand redirect chains, inspect certificates, check domain age and decode QR codes.
The link tools deliberately stop short of loading the page. A redirect trace reads the Location header at each hop and follows it — 301, 302, 307, 308 and meta refresh — recording the status code each server actually returned, up to ten hops, with loop detection. A certificate check completes a TLS handshake and reads what the host presents. Domain age comes from ICANN's RDAP service. Because no page is rendered and no script is executed, a hostile destination has nothing to run.
Calculators — 18 tools
Exact age and date arithmetic, timesheets and hours, GPA and course grades, concrete volumes, subnet maths and unit conversion — all in-browser.
These never touch the network. Date arithmetic is fiddly rather than difficult — the awkward parts are leap days, months of unequal length, and the fact that two people asking for "months between" often mean two different things. Each calculator states the counting convention it used alongside the result, and the engine behind them is covered by an automated test suite that runs on every change.
What happens to what you type
Nothing is kept. That is a consequence of how the site is put together rather than a promise we ask you to take on trust:
- There is no database, so there is nowhere for a submitted domain, URL, header block or password to be written.
- There are no accounts, so there is no profile for a result to be attached to.
- Query logs are not retained, and no tracking cookie records what you looked up.
- In-browser tools never transmit their input at all, so the question does not arise.
One exception, and it is opt-in. A few link checks can consult public reputation feeds, and that necessarily means sending the URL to those third parties. It is a checkbox, unticked by default, and clearly labelled where it appears.
The site does load Google Analytics and Google AdSense, which is how it stays free. Those see ordinary page-visit data; they do not receive the values you enter into a tool. The privacy policy is the precise version of this paragraph.
Where the answers come from
Every result traces back to a published standard or a public register, and each tool page names the one it implements:
- Email — SPF (RFC 7208), DKIM (RFC 6376), DMARC (RFC 7489), MTA-STS (RFC 8461), TLS-RPT (RFC 8460), header format (RFC 5322), and the BIMI draft with its SVG Tiny P/S logo profile.
- Links — DNS over HTTPS for record lookups, a live TLS handshake for certificates, HTTP status codes for redirects, ICANN RDAP for registration dates, and Unicode script tables for look-alike detection.
- Calculators — proleptic Gregorian date arithmetic, with the convention each tool uses stated on its own page.
Two honest limits. A lookup shows what was published at the moment it ran, and DNS answers can be cached upstream, so a record you changed minutes ago may not have propagated. And a clean result means these checks found nothing — not that something is safe. More on how the tools are checked, or the deeper architecture notes.