Security Tools

Generate memorable, high-entropy passphrases from the EFF 7,776-word list using crypto-secure randomness or your own physical dice rolls, with entropy and crack-time estimates.

Generate TOTP 2FA codes and QR codes for authenticator apps. Supports otpauth:// URIs, multiple accounts, and backup export. 100% client-side.

Encrypt and decrypt text with various algorithms

Generate Apache .htaccess configuration files with an intuitive visual interface. Create SSL redirects, URL rewriting rules, security headers, and performance optimizations without writing complex syntax.

Generate free Content Security Policy headers online. Protect your website from XSS attacks, clickjacking, and other code injection attacks with our CSP generator tool. No signup required.

Generate Subresource Integrity hashes

Generate privacy policy for websites

Generate RSA 2048/3072/4096-bit public and private key pairs in-browser via the Web Crypto API. Export as PEM or Base64.

Convert JSON Web Keys (JWK) to PEM format and back using the Web Crypto API. Supports RSA, EC (P-256, P-384, P-521), and Ed25519 keys. 100% client-side.

Verify passwords against bcrypt hashes

Clean and sanitize data to prevent XSS attacks and SQL injection

Generate HMAC for message authentication

Compute CRC-16 checksums for Modbus, CCITT, XMODEM, Kermit, X-25, DNP3 and more, with full polynomial parameters

Calculate CRC32 checksums for file verification

Generate .htpasswd files for Apache authentication

Generate self-signed SSL certificates for development

Generate secure PHP-compatible password hashes with bcrypt. Includes password strength indicator and hash verification.

Generate and verify digital signatures

Calculate and verify file hashes

Generate and verify bcrypt password hashes with an adjustable cost factor. Secure client-side hashing.

Encrypt or decrypt text with a key using the XOR cipher. Ciphertext is output as hex; decrypt input also accepts hex.

Generate RipeMD-128, RipeMD-160, RipeMD-256, and RipeMD-320 hashes from text

Encrypt or decrypt text with AES-128, AES-192, or AES-256 in GCM mode using a password. PBKDF2 key derivation, 100% client-side.

Compute Adler-32 checksums from text or files in-browser, used by zlib and DEFLATE

Scan your regular expressions for catastrophic backtracking (ReDoS) vulnerabilities. Get a safety score, identify dangerous patterns, and test against sample input — all in your browser.

Partially mask sensitive strings like tokens, IBANs, and credit card numbers into safe shareable forms

Generate secure BIP39 seed phrases (12-24 words) with checksums, validate phrases, and derive wallet seeds. Official English wordlist, 100% in-browser.

Generate CSP, HSTS, X-Frame-Options, Referrer-Policy, and Permissions-Policy security headers. Export to nginx, Apache, Express, Caddy, and Cloudflare Pages. Free online tool.

Generate OAuth 2.0 PKCE code_verifier and code_challenge (S256/plain) pairs entirely in-browser via the Web Crypto API. RFC 7636 compliant.

Generate and verify Argon2id password hashes locally with WebAssembly.

Free online Thai National ID validator. Verify 13-digit Thai citizen ID numbers with checksum verification and per-digit breakdown. 100% client-side and private.

Validate 15-digit IMEI numbers with the Luhn checksum and decode TAC, reporting body, and serial fields. Runs in your browser.

Hide secret text inside a PNG with LSB steganography and extract it back in your browser. Nothing is uploaded.

Generate an RFC 9116 security.txt file for your domain with contacts, encryption key, policy, and expiry fields.

Build Permissions-Policy HTTP headers that allow or block browser features like camera, geolocation, and payment per origin.

Build Strict-Transport-Security (HSTS) headers with max-age, includeSubDomains, and preload plus a preload-readiness checklist and ready-to-paste server snippets.

Build a Referrer-Policy security header from all 8 W3C directives, see exactly what referrer data leaves your site in each scenario, and copy ready nginx, Apache, Express, and meta tag snippets.

Decode X.509 PEM certificates and CSRs in your browser. Inspect subject, issuer, SANs, validity, serial number, and key type without uploading anything.

Build and validate IAM policy JSON with statements, actions, resources, principals, and condition blocks.

Generate copy-paste openssl commands for CSR creation, self-signed certificates, key conversion, and certificate inspection.

Build CVSS v4.0 and v3.1 vectors and calculate base severity scores with plain-language explanations.

Paste any hash and instantly identify the likely algorithm from its length, charset, and signature prefixes such as bcrypt, Argon2, or sha512crypt — free and 100% client-side.

Detect and redact personally identifiable information (PII) in text — emails, phone numbers, credit cards, SSNs, IBANs, IP addresses, and credential or API key patterns. Runs entirely in your browser.

Decode WebAuthn and FIDO2 passkey payloads: clientDataJSON, attestationObject CBOR, authenticator flags, AAGUID, credential ID and COSE public key, entirely in your browser.

Generate VAPID key pairs for Web Push notifications using the Web Crypto API. P-256 keys in base64url format, generated entirely in your browser.

Generate SHA3-224, SHA3-256, SHA3-384, SHA3-512 and Keccak-256/512 hashes of text or files entirely in your browser.

Convert email addresses into spam-proof obfuscated forms with copy-paste HTML and JavaScript snippets.

Decode Microsoft Outlook SafeLink wrapper URLs (safelinks.protection.outlook.com) back to the original destination - see the region, tracking parameters, and phishing red flags, entirely in your browser

Generate HTTP Basic Auth Authorization headers from a username and password. Base64 via UTF-8 or Latin-1, with curl and fetch snippets and an .htpasswd preview — 100% in your browser.