Methodology
This page states what a reader is entitled to assume about anything published here, and what they are not.
Every command was run
The output block under a command holds the output that command produced, trimmed where a line was irrelevant and marked with an ellipsis where text was cut. Nothing is reconstructed from memory or from documentation. When a command could not be run, the procedure was not written.
Each page carries a verified date. That is the day the commands last ran and produced the output shown. A procedure whose output changes on a later run gets a new date and a new output block, not a silent edit.
Tool versions are named
The verified block lists the exact build that produced the output. This matters more than it sounds. Two builds of curl on the same machine can disagree about whether a server speaks HTTP/2: a build without nghttp2 answers 1.1 for a server that negotiates h2, and it reports no error while doing it. A procedure that did not name its build would teach the wrong conclusion.
A page ships only with something the documentation does not have
Before publication each procedure is read with the tool’s own documentation open, and everything the documentation already covers is struck out. What has to remain is at least one of: a real output with a line-by-line reading, a threshold with the source it comes from, a failure mode from practice that the documentation does not mention, or an annotated screenshot. If nothing remains, the page is not published.
Demand is checked before a page is written
A procedure exists because people search for it. Queries come from a manual list plus Google and Bing autocomplete, question-shaped and check-shaped search result titles, and Stack Overflow questions, and a query is accepted when it is on the manual list or appears in at least two independent sources. Two ids taken from one search count once. Completeness is not a goal. There is no page for a check nobody asks about.
How the checkers work
8 checkers run as JavaScript inside your browser tab. A JWT, a schema or a cron expression pasted into one of them stays in the tab: there is no request, so there is nothing to log, intercept or subpoena. Reading the code in the page source is enough to confirm that.
11 further checks need a server, because a browser cannot read another site’s TLS handshake or response headers: the same-origin policy stops it. That service is not deployed yet. When it is, it will run at h2check.org/api/ with the guarantees in the next section, and every procedure that would use it already carries the terminal command that gives the same answer today.
What is not stored
Browser checkers: nothing is transmitted, so nothing is stored. No analytics call is made when you run one.
Server checkers, once deployed: the URL you check and the result are not written to any log or database. What is recorded is a counter per checker, the response status, the duration and an error code. That is enough to know the service is alive and not enough to reconstruct what anyone checked.
The service will refuse private and loopback addresses, cloud metadata endpoints and redirects that lead to them, and will rate limit by caller and by target host, so it cannot be turned into a scanner pointed at someone else.
What this site does not do
There is nothing for sale here and no form to fill in. There are 440 procedures, and the only thing any of them asks you to do is run a check on something you are responsible for.
Corrections
An output that no longer matches, a threshold that moved, a step that breaks on a current version: these are worth reporting and get a new verified date when fixed. Contact has the address.