Security

Security Tools

Security tools that generate and check secrets: passwords, passphrases, API keys and UUIDs, plus strength scoring in bits of entropy and hashing. Generated in your browser.

32
Tools in security
0
Accounts needed
API Key Generator
Key length, Prefix → API key
Brute-Force Time Estimator
Password to test → Entropy
Checksum Calculator
Text → CRC32, SHA-256
Common Password Checker
Password → Result
CRC32 Calculator
Text → CRC32
Hash Generator
Text to hash, Algorithm → Hash
Hash Verifier
Text, Expected hash → Result
HMAC Generator
Message, Secret key → HMAC
JWT Secret Generator
Length → JWT signing secret
Nonce Generator
Length → Nonce
Passphrase Generator
Number of words, Separator → Passphrase
Password Entropy Calculator
Password → Entropy
Password Generator
Length, Uppercase A-Z → Password
Password Policy Checker
Password → Rules passed
Password Strength Checker
Password → Entropy
Random String Generator
Length, Characters → String
Recovery Code Generator
How many codes → Recovery codes
Salt Generator
Length → Salt (hex)
Secure Token Generator
Length → URL-safe token
Secure UUID Generator
How many → UUIDs
AES Encrypt / Decrypt
Action, Text (plain text to encrypt, or the encrypted bundle to decrypt) → Status, Result
AES Key Generator
Key size, How many → Status, Key (hex), Key (Base64)
RSA Key Generator
Algorithm, Intended use (RSA only) → Status, Public key (PEM), Private key (PEM)
TOTP Generator
Secret (Base32, as shown by the app or QR code), Digits → Status, Current code, Next code
File Hash Calculator
Reads the file in your browser and computes CRC32, SHA-1, SHA-256, SHA-384 and SHA-512 with…
SRI Hash Generator
Subresource Integrity is the Base64 of the file's SHA-384 (or 256/512) digest, prefixed with…
PBKDF2 Hash Generator
Password, Salt (leave blank for a random 16-byte salt) → Status, Derived key (hex), PHC string
Credit Card Validator
Action, Card number → Result, Details
SSH Key Fingerprint
OpenSSH public key (authorized_keys / id_*.pub line) → Fingerprint, Key type, Bits
Security Headers Analyzer
Response headers (paste from curl -I or DevTools) → Grade, Score, Report
Cookie Security Checker
Set-Cookie header(s), one per line → Result, Issues, Report
Hash Identifier
Hash or token (one per line) → Result, Identification

What the security tools cover

These tools generate and check secrets: random passwords, word-based passphrases, tokens, API keys, salts, nonces and UUIDs. The checking side covers password strength measured as entropy in bits, an estimate of brute-force time at published GPU guessing rates, a common-password list, hashing, HMAC signing and checksum verification.

Randomness comes from the browser's cryptographic source (crypto.getRandomValues), not Math.random, which makes the output suitable for real credentials. Nothing generated here is transmitted or logged. A password generator that sends its output to a server is worse than no generator at all, and that is the only acceptable design for this category.

What the numbers mean

  • Entropy assumes every character was chosen independently at random. A phrase you composed yourself has far less entropy than its length suggests.
  • Crack-time estimates assume an offline attack on a fast, unsalted hash. Behind bcrypt or Argon2 the same password survives thousands of times longer.
  • Length beats complexity rules. Twelve random lowercase letters are stronger than eight characters drawn from every key on the keyboard.
  • A generated secret is only as safe as wherever you store it afterwards. Use a password manager.

The newer tools use the browser's Web Crypto engine for real cryptography: encrypt and decrypt text with AES-256-GCM, generate AES keys and RSA, ECDSA or Ed25519 key pairs as PEM, produce TOTP authenticator codes, hash a downloaded file and compare its checksum, build Subresource Integrity attributes, derive PBKDF2 password hashes, fingerprint an SSH public key, and audit what a server sends: response headers and cookie flags. A hash identifier names the algorithm behind an unknown digest and a Luhn validator checks card numbers for forms.