What Is a Secure Context Checker?
This tool reads your browser's real window.isSecureContext flag - a genuine security
classification your browser calculates for the current page - and then actually tests whether several
sensitive, security-gated web APIs are truly available or blocked as a direct consequence. Rather than just
explaining the concept abstractly, this shows the real, live effect of secure context status on actual API
availability in your current browser session.
How to Use the Secure Context Checker
- Load this page - the secure context status and API checks run automatically.
- Check whether "Secure Context" shows Yes or No.
- Review the API grid to see exactly which sensitive capabilities are actually available as a result.
How It Works
window.isSecureContext is a genuine browser-calculated boolean reflecting whether the
current page meets the security requirements to access sensitive APIs - generally true for HTTPS pages and
for localhost during development, and false for plain HTTP pages on any other domain. This tool then
directly tests for the actual presence of several APIs known to be gated behind secure context
requirements, checking each one's real existence in the current environment rather than assuming based on
the secure context flag alone.
Understanding Your Results
- Secure Context "Yes" with most APIs available - the expected result on a properly configured HTTPS page; sensitive capabilities are unlocked as designed.
- Secure Context "No" with APIs showing blocked - confirms the direct real-world impact of an insecure connection; many modern web capabilities simply won't function until the page is served over HTTPS.
- An API shows "BLOCKED/MISSING" even with Secure Context "Yes" - that specific API may not be supported in your particular browser at all, independent of secure context, or may require an additional permission grant beyond just being in a secure context.
Browser Limitations
This tool checks for the raw presence of each API's core function, which confirms the API is exposed at all - some APIs additionally require a user permission grant on top of secure context before they're actually usable, so "AVAILABLE" here means the capability exists and can be requested, not necessarily that permission has already been granted.
Common Mistakes to Avoid
- Confusing secure context with permission status - secure context determines whether an API is exposed at all; actually using many of these APIs still requires a separate permission grant on top of that.
- Assuming all APIs require secure context - many standard web features work regardless of secure context; only specifically sensitive APIs are gated this way.
- Testing on localhost and generalizing to production - localhost is treated as secure for development convenience even without HTTPS, which won't hold true once deployed to a real domain.
Frequently Asked Questions
Why do browsers restrict certain APIs to secure contexts?
Sensitive capabilities like camera access, clipboard writing, and cryptography functions could be abused if available over an insecure, interceptable connection, so browsers require the stronger guarantees of HTTPS (or localhost) before exposing them.
Why does localhost count as secure even without HTTPS?
Browsers treat localhost as inherently trusted for development purposes, since it's running on your own machine rather than being transmitted over a network where interception could occur.
Does "AVAILABLE" mean an API is already actively granted permission?
Not necessarily - it confirms the API itself is exposed by your browser; several of these still require you to separately grant permission the first time a website actually requests to use them.
Is any data collected by checking these APIs?
No, this tool only checks for each API's existence and presence - it doesn't call or activate any of them, and nothing is transmitted or recorded.
Can I fix a "No" secure context result myself?
If you're the site owner, switching to HTTPS resolves this; if you're a visitor to a site showing this result, the site itself needs to be updated to use HTTPS.
Conclusion
Seeing exactly which real capabilities secure context unlocks makes the concept concrete rather than abstract. For a direct check of your connection's HTTPS status specifically, pair this with the HTTPS Checker.