Trust Center
Where Nexinon proves, live and in your own browser, the privacy and security it promises — without relying on open source.
A principle, not an empty promise
Nexinon handles passwords, secrets and sensitive data every day — and the source code is private ("Private code. Public application."), so the classic "trust it because it's open source" argument isn't available here. Instead of asking you to take our word for it, this page shows you: the network monitor below is your own browser reporting what leaves your machine; the two analyzers test nexinon.dev exactly as they would test any other site; and the note at the bottom of the page is about honesty, not marketing.
Live network monitor
Every network call made by this browser, captured in real time — not a claim, a witnessed proof.
https://nexinon.dev/api/v1/session/token
Nexinon testing itself
The two analyzers below are already part of the catalog — here they run on their own against nexinon.dev itself, nothing to type.
security.txt
Published at /.well-known/security.txt (RFC 9116) — the standard channel the security community uses to report a vulnerability to any domain.
Open /.well-known/security.txtExecution transparency, tool by tool
Every tool in the catalog already declares this on its own page (local, server, or hybrid) — here it's all together, in a single table. Generated from the same registry that powers the Home page: it never goes stale on its own.
| Tool | Execution | Summary |
|---|---|---|
| Password Checker | Hybrid | nothing leaves your browser by default — the only exception is the optional leak check, under your explicit action. |
| Secret Share | Hybrid | everything is encrypted in your browser — not even Nexinon can read what you share. |
| Secret Request | Hybrid | the question and the response are encrypted in the browser — not even Nexinon can read them. |
| DNS Lookup | Server | the domain you type goes to the server at query time — nothing is stored. |
| WHOIS | Server | the domain you type goes to the server at query time — nothing is stored. |
| SSL/TLS Checker | Server | the domain you type goes to the server at query time — nothing is stored. |
| Security Headers | Server | the URL you type goes to the server at analysis time — nothing is stored. |
| Mock API | Server | the pasted JSON and the management token stay on the Nexinon server until the mock expires. |
| IP Lookup | Server | the IP you query goes to the server at lookup time — nothing is stored. |
| Is It Down? | Server | the URL you type goes to the server on check — nothing is stored. |
| Paste Share | Hybrid | by default, content is sent as plain text to the server; with encryption on, everything happens in your browser. |
A note on honesty
Nexinon's source code is not public — "Private code. Public application." is a deliberate project decision, not an "auditable by anyone" site. What this page offers is different and, for most people, more direct: behavioral proof, observable at runtime, that you can verify again at any moment — the network monitor shows real traffic from your own session, the two analyzers run against the real domain, security.txt is a genuine public file. None of this proof requires knowing how to read code.