Free Security Tools

Generate cryptographically strong passwords, passphrases and PINs, with customizable length, character types and strength analysis. Uses your browser's Web Crypto API.

Generate and verify MD5, SHA-256, SHA-512, bcrypt, Argon2id, scrypt, and PBKDF2 hashes. Supports OWASP-recommended algorithms for password hashing.

Encode and decode Base64 strings with full Unicode (UTF-8) support. Instantly convert between plaintext and Base64 in either direction.

Share code snippets and text securely with AES-256 encryption, automatic expiration, and view limits. Your pastes are encrypted and permanently deleted after use.

Encode and decode URLs with percent-encoding. Supports both encodeURI and encodeURIComponent modes with full UTF-8 support.

Format, validate, minify, escape, unescape, and diff JSON documents instantly. Supports deep key sorting, real-time validation, and line-by-line comparison.

Decode, inspect, and validate JSON Web Tokens instantly. View header, payload, and claims with expiry analysis. Verify HMAC signatures.

Convert between Unix timestamps, ISO 8601, and human-readable dates. Supports seconds, milliseconds, and auto-detection with live clock.

Generate HMAC-SHA256, SHA384, and SHA512 signatures for API authentication and webhook verification. Hex and Base64 output with JSON normalization.

Encrypt and decrypt text with AES-256-GCM or AES-256-CBC using a password. PBKDF2 key derivation with 100k iterations. Base64 output.

Analyze password entropy, estimate brute-force crack times across 4 attack tiers, detect common patterns, and get improvement suggestions.

Convert between JSON and YAML instantly. Validation, indentation control (2/4/8 spaces), and file download. Great for DevOps config files.

Generate cryptographically secure API keys in hex, Base62, or Base64 format. Configurable length, prefix, batch generation, and entropy calculation.

Split secrets into multiple shares with configurable M-of-N threshold. Any T shares can reconstruct the original — fewer reveal nothing.

Build Content Security Policy headers visually. Configure directives, pick presets, and copy your policy as an HTTP header or meta tag.

Build environment variable files visually. Pick framework presets, generate secrets, and download your .env file.

Answer eight questions about one credential workflow and get up to three first actions, each with an owner and a completion check.

Strip every value from .env files or HTTP headers before sharing a diagnostic. Comments and request bodies are removed too.