Most CipherForces tools run entirely in the browser, but three documented tools use a CipherForces API route. The SSL Certificate Checker performs a TCP handshake to the target host. The Privacy Report Card fetches a URL to analyze its privacy posture. The Password Strength and Breach Checker runs a k-anonymity check against the Have I Been Pwned database, and the password itself never leaves the device. All three routes are rate-limited, SSRF-protected, and discard request data after returning the result.