Security & Crypto

Free Content-Security-Policy analyzer. Paste a CSP header value to parse every directive into a clear table, surface risky sources like 'unsafe-inline', 'unsafe-eval', wildcards, data: and http:, catch missing default-src / object-src / base-uri, and get an A–F grade. 100% client-side, nothing is uploaded.

Inspect JWKs, JWKS documents, PEM keys, and CSRs, then convert between JWK and PEM formats.

Free, fully client-side secrets scanner. Find AWS access keys, Google API keys, GitHub tokens, Slack tokens, Stripe keys, JWTs, private key blocks and generic api_key/password assignments in pasted code, with line numbers and masked previews. No data ever leaves your browser.

A reference and generator for HTTP security response headers with descriptions, recommended values, and server config snippets.

Decode JWT headers and payloads, inspect exp / iat, and verify HS256 or RS256 signatures.

Forge signed JWTs in your browser — HMAC, RSA, ECDSA, key-pair generation, and a live signature check, never leaving the page.

Generate a valid RFC 9116 security.txt with contact, expiry, encryption key, policy and more, then deploy it at /.well-known/security.txt.

Generate cryptographically-secure random tokens — hex, Base64, UUIDs, API keys, passphrases — entirely in your browser.

Generate and verify bcrypt hashes locally with adjustable cost (4-15). Strong password generator, strength meter, parsed-hash inspector, education sidebar.

Generate HMAC-SHA-1 / 256 / 384 / 512 signatures with Web Crypto. Hex / Base64 / Base64URL output, key encoding picker, verify mode, webhook signature templates.

Generate live RFC 6238 TOTP codes from a base32 secret. Multi-account manager, otpauth QR provisioning, verifier with clock drift tolerance.

Generate batches of ULIDs (sortable, timestamp-encoded) and NanoIDs (URL-safe, custom alphabet). Includes decoder, comparator, and collision calculator.

Encrypt text or files locally with AES-256-GCM and PBKDF2 (600k iterations). Nothing leaves your browser.

Visually build, audit, and ship hardened Content-Security-Policy headers with nonces, hashes, and ready-to-paste server snippets.

Generate strong random passwords with character-set toggles and a simple strength check.

Generate SHA digests or HMAC signatures and copy the result in hex or Base64 form.

Hash uploaded files in the browser and copy the checksum as hex or Base64.

Identify hash algorithms by format — bcrypt, Argon2, MD5, SHA family, NTLM, JWT and 40+ more.

Generate UUID v1, v4, or v7 values in batches and copy or download them instantly.

Validate IBANs with MOD 97, see country breakdown, generate test IBANs, and convert BBAN ↔ IBAN.

Validate card numbers with Luhn, detect the brand, and generate Luhn-passing test cards — all in your browser.