Security Tools

.env File Checker

Lint a .env file for syntax errors, duplicates and weak secrets.

Account Security Checklist

A prioritised checklist to secure email, bank, social and work accounts.

AES Key Generator

Random AES-128, 192 or 256-bit keys in hex, Base64 or JWK.

API Key Generator

Random prefixed API keys with an optional checksum, like GitHub tokens.

Backup Code Generator

Random two-factor recovery codes, grouped for easy reading.

Base32, Base58 And Base85 Encoder

Encode and decode Base32, Base58, Ascii85 and Z85.

Basic Auth Header Generator

Build or decode an HTTP Authorization Basic header.

Bcrypt Cost Benchmark

Time bcrypt cost factors and pick one that fits your login budget.

Bcrypt Generator

Generate and verify bcrypt password hashes.

Bearer Token Decoder

Decode an Authorization header and find out what kind of token it is.

Certificate Chain Order Checker

Check your SSL certificate bundle is complete and in the right order.

Certificate Expiry Calculator

See days left and the renewal date for any PEM certificate.

Checksum Verifier

Check several files against a SHA256SUMS list, like sha256sum -c.

Chmod Cheat Sheet

Permission digits, common modes and special bits on one page.

Classic Ciphers

Vigenère, Beaufort, Atbash, ROT47 and rail fence, encode and decode.

Cookie Consent Checker

Find analytics and ad cookies set before visitors give consent.

CORS Tester

Test a URL for CORS headers or analyse pasted ones.

CRC32 Calculator

CRC-32, CRC-32C and Adler-32 checksums of text or hex bytes.

CSP Builder

Build a Content-Security-Policy header from per-directive source lists.

CSP Tester

Explain a CSP, flag weaknesses, and test whether a URL would load.

CSR Decoder

Decode a CSR, verify its signature and spot problems before submitting.

CVE ID Validator

Check a list of CVE IDs for format errors and duplicates.

CVSS Calculator

Score a vulnerability with CVSS 3.1 from metrics or a vector.

Data Breach Notification Deadline Calculator

Work out the exact deadlines to report a data breach.

Data URI Decoder

Decode a data URI and check what its payload really contains.

DMARC Record Generator

Build a DMARC record with the right policy and report addresses.

DMARC Report Viewer

Turn a DMARC aggregate XML report into a readable table.

EC Key Generator

Elliptic curve and Ed25519 key pairs as PEM or JWK.

Email Header Analyzer

Trace an email's route and check its SPF, DKIM and DMARC results.

EXIF Stripper

Cut GPS and camera metadata out of a photo, losslessly.

Face Blur

Detect every face in a photo and blur or pixelate it automatically.

File Encryptor

Password-encrypt any file with AES-256-GCM, without uploading it.

File Hash Checker

Hash a file and check it against the published checksum.

File Type Identifier

Check a file's real type from its bytes and spot disguised programs.

Firewall Rule Explainer

Explain iptables and ufw rules in plain English and flag risky ones.

Git Secret Removal Guide

Step-by-step commands to purge a leaked secret from git history.

Hash Generator

Generate MD5, SHA-1, SHA-256 and SHA-512 digests from text.

Hex Dump Viewer

View any file as hex and ASCII, with type detection and entropy.

HMAC-SHA256 Generator

Sign a message with HMAC-SHA256 and verify signatures.

Homograph Checker

Detect lookalike domains that swap letters to imitate real brands.

HOTP Generator

Counter-based one-time passwords from a base32 secret, listed in a table.

HSTS Preload Checker

Check a Strict-Transport-Security header against the HSTS preload rules.

HTTP Header Inspector

Parse pasted HTTP headers, explain each one and audit security.

Image Redactor

Black out or pixelate parts of an image for good.

Image Steganography

Hide or reveal text in an image's low bits.

Incident Response Checklist

A step-by-step checklist for the security incident you are facing.

IP Allowlist Builder

Turn a list of IPs into allow or block rules for your server.

IP Range To CIDR Converter

Turn start and end IP addresses into the fewest CIDR blocks.

JavaScript Deobfuscation Helper

Decode hidden strings in obfuscated JavaScript and flag risky calls safely.

JWKS Inspector

List every key in a JWKS and flag leaks, weak keys and duplicates.

JWT Decoder

Decode a JWT and read its claims and expiry.

JWT Encoder

Sign a JSON payload into an HS256, HS384 or HS512 JWT.

JWT Signature Verifier

Verify a JWT's signature with a secret, PEM key or JWKS.

Link Unwrapper

Reveal the real destination behind Safe Links and tracking redirects.

Updated

MAC Vendor Prefixes

Find the manufacturer behind a MAC address from the IEEE OUI registry.

Memorable Password Generator

Random words, a symbol and digits — strong, and you can remember it.

Multi Decoder

Detect and unwrap nested Base64, URL, hex and entity encodings automatically.

NTLM Hash Generator

Windows NTLM and LM hashes of a password, computed in your browser.

OAuth PKCE Generator

PKCE code verifier and S256 challenge for OAuth 2.0 testing.

OAuth State And Nonce Generator

Random OAuth state and OpenID nonce values for sign-in testing.

Office Metadata Remover

Strip author, company and hidden properties from Word, Excel and PowerPoint files.

Otpauth URI Decoder

Break an otpauth:// 2FA link into issuer, secret and settings.

OWASP Top 10 Reference

The OWASP Top 10 web risks with plain explanations and fixes.

Passphrase Generator

Diceware passphrases from the EFF wordlist, generated locally.

Password Generator

Strong random passwords generated in your own browser.

Password Hash Generator

Argon2id, scrypt and PBKDF2 password hashes with OWASP defaults.

Password Hash Identifier

Identify bcrypt, Argon2, sha512crypt, NTLM, MD5 and other hash formats.

Password Policy Generator

Write a modern NIST-based password policy for your organisation.

Password Policy Tester

Test a list of passwords against length, character and banned-word rules.

Password Strength Checker

Estimate a password's entropy, crack time and weak patterns.

Password Strength Meter

Colour-coded password strength bar with a small scoring script.

Password Visibility Toggle

Show/hide password button with eye icon or text and correct ARIA state.

PDF Metadata Remover

Strip author, dates and hidden XMP metadata from a PDF privately.

PDF Redactor

Black out and truly delete words from a PDF, not just cover them.

PEM Inspector

Decode PEM and DER into a readable ASN.1 tree.

PEM To JWK Converter

Convert public and private keys between PEM and JWK.

Permissions-Policy Builder

Build a Permissions-Policy header feature by feature, with server config.

Phishing URL Checker

Check a suspicious link for look-alike domains and phishing tricks.

Port Number Lookup

See what runs on a port and whether exposing it is risky.

Punycode Converter

Convert domains between Unicode and xn-- Punycode in both directions.

Pwned Password Checker

Check a password against breach data without sending the password.

QR Code Decoder

Read a QR code from an image and check it before opening.

Random PIN Generator

Random 4, 6 or 8 digit PINs, avoiding 1234 and 0000.

Random String Generator

Cryptographically random strings in any length and character set.

Redaction Checker

Find names and numbers still readable in a "redacted" document.

Referrer Policy Explainer

See the Referer each Referrer-Policy value sends from your page.

Robots.txt Sensitive Path Checker

Spot robots.txt rules that point attackers at sensitive paths.

ROT13 And Caesar Cipher

Encode and decode ROT13 and Caesar shift ciphers.

RSA Key Generator

RSA key pairs as PEM or JWK, made in your browser.

SameSite Cookie Tester

See when each cookie is sent cross-site under its SameSite setting.

Secret Scanner

Find leaked API keys, tokens and passwords in pasted code.

Secret Splitter

Split a secret into shares; any threshold of them rebuilds it.

Secure Note

Share a password as an encrypted link that no server ever sees.

Security Headers Checker

Check pasted response headers for missing, weak and leaky security headers.

Security Headers Generator

Generate HTTP security headers for nginx, Apache, Netlify and Express.

Signature Verifier

Check whether a signature over a message matches a public key.

SPF Record Generator

Build an SPF record from the email services you actually use.

SRI Hash Generator

Subresource Integrity hashes and tags for scripts and stylesheets.

SSH Key Converter

Convert SSH public keys between OpenSSH, SSH2 and PEM formats.

SSH Key Fingerprint

Get ssh-keygen style SHA256 and MD5 fingerprints from any public key.

SSL Certificate Inspector

Decode a PEM certificate and check its dates, names and fingerprints.

Text Encryptor

Encrypt and decrypt messages with a passphrase, AES-256-GCM in your browser.

TLS Cipher Suites

Every IANA TLS cipher suite with its code, parts and status.

TOTP Generator

Live two-factor codes from a base32 secret, with a countdown.

TOTP QR Code Generator

Authenticator app setup QR codes from a secret, issuer and account.

Unicode Confusables Detector

Find lookalike and invisible Unicode characters hiding in text.

UUID Decoder

Decode a UUID into version, variant, timestamp, clock sequence and node.

UUID Generator

Random v4 or time-ordered v7 UUIDs, generated in your browser.

UUID Validator

Check a list of UUIDs and decode their version, variant and timestamp.

WiFi Password Generator

WPA2/WPA3 keys with no look-alike characters, easy to read aloud.

XOR Cipher

XOR with a repeating key, or brute-force every single-byte key.