What the security tools cover
These tools generate and check secrets: random passwords, word-based passphrases, tokens, API keys, salts, nonces and UUIDs. The checking side covers password strength measured as entropy in bits, an estimate of brute-force time at published GPU guessing rates, a common-password list, hashing, HMAC signing and checksum verification.
Randomness comes from the browser's cryptographic source (crypto.getRandomValues), not Math.random, which makes the output suitable for real credentials. Nothing generated here is transmitted or logged. A password generator that sends its output to a server is worse than no generator at all, and that is the only acceptable design for this category.
What the numbers mean
- Entropy assumes every character was chosen independently at random. A phrase you composed yourself has far less entropy than its length suggests.
- Crack-time estimates assume an offline attack on a fast, unsalted hash. Behind bcrypt or Argon2 the same password survives thousands of times longer.
- Length beats complexity rules. Twelve random lowercase letters are stronger than eight characters drawn from every key on the keyboard.
- A generated secret is only as safe as wherever you store it afterwards. Use a password manager.
The newer tools use the browser's Web Crypto engine for real cryptography: encrypt and decrypt text with AES-256-GCM, generate AES keys and RSA, ECDSA or Ed25519 key pairs as PEM, produce TOTP authenticator codes, hash a downloaded file and compare its checksum, build Subresource Integrity attributes, derive PBKDF2 password hashes, fingerprint an SSH public key, and audit what a server sends: response headers and cookie flags. A hash identifier names the algorithm behind an unknown digest and a Luhn validator checks card numbers for forms.