Security Tools
Security and authentication utilities: decode and sign JWTs, generate and compare hashes, build CSP headers, check password strength and breaches, create TOTP codes — nothing leaves your browser.
37 free tools — no ads, no sign-up, everything runs in your browser.
AES Encryption
Encrypt and decrypt text with AES-GCM and a passphrase, fully in your browser. Uses PBKDF2 key derivation and the Web Crypto API — your data and keys never leave your device.
Basic Auth Generator
Generate an HTTP Basic Authentication header from a username and password. Produces the Authorization header and ready-to-use curl and fetch snippets. Runs fully client-side.
Bcrypt Generator & Verifier
Hash passwords with bcrypt and verify hashes — choose your cost factor (rounds 4–15), get a secure hash instantly, and check whether a password matches a hash. Runs entirely in your browser.
BIP39 Mnemonic Generator
Generate and validate BIP39 seed phrases locally for testing
Checksum Calculator
Compute file checksums (SHA-1, SHA-256, SHA-384, SHA-512) in your browser with the Web Crypto API
Client-Side File Encryptor
Encrypt any file with AES-256-GCM and PBKDF2 directly in your browser — no uploads, no accounts, wrong passwords fail loudly.
CORS Header Validator
Validate Cross-Origin Resource Sharing headers for security compliance
CORS Policy Builder
Build CORS response headers, Nginx directives, and JavaScript fetch examples for safe cross-origin requests and preflight handling
Credit Card Validator
Validate credit card numbers with the Luhn algorithm and detect the issuing network
CSP Builder & Validator
Build a Content-Security-Policy visually and audit an existing header for unsafe directives, wildcards and missing protections — with a risk score and fixes.
CSR Decoder
Decode a PEM Certificate Signing Request (PKCS#10) in your browser — inspect its subject, public key, signature algorithm and subject alternative names.
Email Validator
Validate email addresses with RFC 5322 syntax checking, disposable/temporary email detection, and domain verification. Client-side only.
EXIF & Metadata Stripper
Remove EXIF, GPS and hidden metadata from JPG and PNG images before sharing — with a full report of everything removed.
GPG Symmetric Encryption
Passphrase encrypt and decrypt with AES-GCM armored DevTools format (not OpenPGP compatible)
Hash Comparison Tool
Compare hash values and generate hashes from text for verification
Hash Generator
Generate multiple cryptographic hashes with comprehensive analysis, security information, file upload, and multiple output formats
HMAC Generator
Generate HMAC signatures (SHA-1, SHA-256, SHA-384, SHA-512) from a message and secret key using the Web Crypto API. Output in hex or Base64, computed entirely in your browser.
HTTP Security Header Checker
Audit pasted HTTP response headers for HSTS, CSP, clickjacking, MIME sniffing, referrer, permissions, and opener protections
JavaScript Obfuscator
Obfuscate and minify JavaScript code to protect your source code. Basic obfuscation with variable renaming and string encoding.
JWT Signer
Create and sign JSON Web Tokens with HMAC, RSA, or ECDSA algorithms using the Web Crypto API.
JWT Token Decoder
Decode and analyze JSON Web Tokens with security validation
JWT Validator
Verify HS256 and RS256 JWT signatures and validate exp, nbf, aud and iss claims
Password Breach Checker
Check if your password has been exposed in known data breaches using the HIBP database
Password Generator
Generate secure passwords with customizable options including length, character sets, and complexity requirements
Password Strength Checker
Analyze password security with real-time strength scoring and recommendations
PEM Certificate Inspector
Parse a PEM certificate or private key and inspect its fields
PKI Key Pair Generator
Generate RSA keys, self-signed X.509 certificates and certificate signing requests
Security Headers Checker
Grade CSP, HSTS, and related HTTP security headers from a live response
Security.txt Generator
Generate an RFC 9116 security.txt with Contact, Expires, Encryption, Acknowledgments, Policy and more so researchers know how to report vulnerabilities to you
Self-Destructing Encrypted Note
Share a one-time encrypted message: the key travels in the link's #fragment — servers never see it — and the note burns after one read.
SQL Injection Detector
Scan an input string or query for SQL injection signatures — tautologies, UNION SELECT, stacked queries, time-based blind, comments, and destructive statements — with a risk score and classification.
SSH Key Pair Generator
Generate RSA, ECDSA P-256 or Ed25519 SSH key pairs with OpenSSH public format and SHA256 fingerprint
SSL Chain Analyzer
Paste a PEM certificate bundle and verify the chain order — find missing intermediates, broken links, expired or not-yet-valid certificates, self-signed roots, and duplicates. All in-browser.
Text Encryptor
Encrypt and decrypt text with a passphrase using AES-256-GCM and PBKDF2 key derivation — everything happens in your browser, nothing is uploaded or stored
TLS Handshake Simulator
Educational step-by-step TLS 1.2 handshake animation — no network calls
Token Generator
Generate cryptographically secure random tokens, API keys and secrets. Choose hex, Base64url or alphanumeric format with configurable length and count. Uses the Web Crypto API.
TOTP / 2FA Generator
Generate and verify TOTP two-factor authentication codes with QR code export