Launched September 29, 2026
FlashFuzz
Quick URL fuzzing and secret scanning in-browser
FreeSecurityOpen Source2,039 impressions#8 of its week
Fast, lightweight, and designed for security engineers who want immediate reconnaissance without leaving the browser. Quickly identify hidden endpoints and potential secrets across all open tabs.
FlashFuzz is a browser extension that fuzzes URLs, scans for secrets, and performs quick port checks directly in open tabs.
- for
- Security engineers and penetration testers needing fast in-browser reconnaissance
- pricing
- free
- license
- MIT
works withChrome Web StoreFirefox Add-ons
Key features
8 features of FlashFuzz
- URL fuzzing — Fuzzes URLs across all open tabs to discover hidden endpoints.
- Custom wordlists — Supports built-in example lists or user-provided wordlists.
- Concurrent requests — Configurable batch size for parallel fuzzing requests.
- Secret scanning — Scans JavaScript files in tabs for API keys, tokens, and other secrets.
- Quick port scanning — Lightweight port checks on discovered hosts to identify open services.
- Export results — Exports findings for further analysis or reporting.
- Detailed snapshots — Shows request/response details for each discovered endpoint.
- Open source — Free to use under an MIT license with source code publicly available.
Use cases
- Identify hidden admin panels on a target domain during a pen test
- Detect leaked API keys in loaded JavaScript files
- Map open ports on discovered subdomains quickly
- Generate a report of discovered endpoints for client delivery
- Validate custom wordlists against live sites in real time
FlashFuzz vs alternatives
| FlashFuzz |  Pulsetic |  Firecamp |  LAN Orangutan |  Pocketenv | |
|---|---|---|---|---|---|
| Best for | In-browser URL fuzzing and secret scanning | Website uptime monitoring | API testing and debugging | Network scanning with Tailscale | Sandbox runtime for AI agents |
| Pricing | Free | Free | Free | Free | Free |
| DevHunt upvotes | 3 | 162 | 48 | 35 | 73 |
| Launched | Sep 2026 | Jan 2024 | Jan 2023 | Jul 2026 | Apr 2026 |
- FlashFuzz vs Pulsetic: Pulsetic monitors website uptime, not URL fuzzing or secret scanning.
- FlashFuzz vs Firecamp: Firecamp is an API testing tool, whereas FlashFuzz focuses on in-browser fuzzing and secret discovery.
- FlashFuzz vs LAN Orangutan: LAN Orangutan is a network scanner with Tailscale support, while FlashFuzz runs inside the browser for URL-level reconnaissance.
- FlashFuzz vs Pocketenv: Pocketenv provides sandbox runtimes for agents, not browser-based security scanning.
FlashFuzz FAQ
Is FlashFuzz free to use?+
Yes, FlashFuzz is completely free and open source.
Can I use my own wordlist?+
Yes, you can provide a custom wordlist in the settings.
Does FlashFuzz store my data?+
No, all processing occurs locally in the browser; no data is sent to external servers.
How do I install FlashFuzz?+
Install from the Chrome Web Store or Firefox Add-ons, or load the unpacked extension manually.
Summarized by DevHunt from github.com · Sep 28, 2026. Details may change; check the official site.
