If the scanner finds nothing, is my code safe?

Not necessarily. The scanner is heuristic and catches known signatures. Always use parameterized queries/prepared statements, which prevent injection regardless of patterns.

Why was a normal keyword flagged?

Some patterns can appear in benign text. Treat findings as signals to review in context, not as definitive verdicts.

Does it run against my database?

No. It only inspects the text you paste. It never connects to a database or runs the query.

SQL Injection Detector

Scan an input or query for SQL injection signatures and get a risk score

Input to scan

Risk assessment

none risk

0 signatures matched

Common SQL injection patterns

Boolean bypass

' OR '1'='1

Changes a predicate so authentication or filtering always evaluates true.

UNION extraction

UNION SELECT

Appends another result set to expose data from a different table.

Comment truncation

-- or /* … */

Comments out the remainder of a query to bypass password or scope checks.

Time-based probing

SLEEP(5)

Delays the database response to infer true/false conditions without visible output.

Two SQL Reviews Every Query Should Pass

A security review and a performance review for SQL. Catch injection signatures before production, then strip the anti-patterns that make a query slow — without needing a live database.

AES Encryption

Encrypt and decrypt text with AES-GCM and a passphrase, fully in your browser. Uses PBKDF2 key derivation and the Web Crypto API — your data and keys never leave your device.

Basic Auth Generator

Generate an HTTP Basic Authentication header from a username and password. Produces the Authorization header and ready-to-use curl and fetch snippets. Runs fully client-side.

Bcrypt Generator & Verifier

Hash passwords with bcrypt and verify hashes — choose your cost factor (rounds 4–15), get a secure hash instantly, and check whether a password matches a hash. Runs entirely in your browser.

BIP39 Mnemonic Generator

Generate and validate BIP39 seed phrases locally for testing

Checksum Calculator

Compute file checksums (SHA-1, SHA-256, SHA-384, SHA-512) in your browser with the Web Crypto API

Client-Side File Encryptor

Encrypt any file with AES-256-GCM and PBKDF2 directly in your browser — no uploads, no accounts, wrong passwords fail loudly.