Launched September 29, 2026
FlashFuzz
Quick URL fuzzing and secret scanning in-browser
FreeSecurityOpen Source2,042 impressions#9 of its week
Fast, lightweight, and designed for security engineers who want immediate reconnaissance without leaving the browser. Quickly identify hidden endpoints and potential secrets across all open tabs.
More Security tools →74 free dev tools →
FlashFuzz is a browser extension that fuzzes URLs, scans for secrets, and performs quick port checks directly in open tabs.
- for
- Security engineers and penetration testers needing fast in-browser reconnaissance
- pricing
- free
- license
- MIT
works withChrome Web StoreFirefox Add-ons
Key features
8 features of FlashFuzz
- URL fuzzing — Fuzzes URLs across all open tabs to discover hidden endpoints.
- Custom wordlists — Supports built-in example lists or user-provided wordlists.
- Concurrent requests — Configurable batch size for parallel fuzzing requests.
- Secret scanning — Scans JavaScript files in tabs for API keys, tokens, and other secrets.
- Quick port scanning — Lightweight port checks on discovered hosts to identify open services.
- Export results — Exports findings for further analysis or reporting.
- Detailed snapshots — Shows request/response details for each discovered endpoint.
- Open source — Free to use under an MIT license with source code publicly available.
Use cases
- Identify hidden admin panels on a target domain during a pen test
- Detect leaked API keys in loaded JavaScript files
- Map open ports on discovered subdomains quickly
- Generate a report of discovered endpoints for client delivery
- Validate custom wordlists against live sites in real time
FlashFuzz vs alternatives
| FlashFuzz |  Pulsetic |  Firecamp |  LAN Orangutan |  Pocketenv | |
|---|---|---|---|---|---|
| Best for | In-browser URL fuzzing and secret scanning | Website uptime monitoring | API testing and debugging | Network scanning with Tailscale | Sandbox runtime for AI agents |
| Pricing | Free | Free | Free | Free | Free |
| DevHunt upvotes | 3 | 162 | 48 | 35 | 73 |
| Launched | Sep 2026 | Jan 2024 | Jan 2023 | Jul 2026 | Apr 2026 |
- FlashFuzz vs Pulsetic: Pulsetic monitors website uptime, not URL fuzzing or secret scanning.
- FlashFuzz vs Firecamp: Firecamp is an API testing tool, whereas FlashFuzz focuses on in-browser fuzzing and secret discovery.
- FlashFuzz vs LAN Orangutan: LAN Orangutan is a network scanner with Tailscale support, while FlashFuzz runs inside the browser for URL-level reconnaissance.
- FlashFuzz vs Pocketenv: Pocketenv provides sandbox runtimes for agents, not browser-based security scanning.
FlashFuzz FAQ
Is FlashFuzz free to use?+
Yes, FlashFuzz is completely free and open source.
Can I use my own wordlist?+
Yes, you can provide a custom wordlist in the settings.
Does FlashFuzz store my data?+
No, all processing occurs locally in the browser; no data is sent to external servers.
How do I install FlashFuzz?+
Install from the Chrome Web Store or Firefox Add-ons, or load the unpacked extension manually.
Summarized by DevHunt from github.com · Sep 28, 2026. Details may change; check the official site.
