Security tools

Hashes, tokens, passwords and encryption — computed locally.

100% client-side Free forever No sign-up

Security tools are the category where "runs in your browser" stops being a convenience and becomes a requirement. A password generator that produces its output on a server is asking you to trust that the server forgot it. A JWT decoder that posts your token somewhere has just been handed a live credential. Everything here is computed by the Web Crypto API inside your own tab, so the secret exists only on your machine.

Tools in this category

Hash Generator (SHA-256, SHA-1, MD5) Compute cryptographic hashes of any text instantly — SHA-256, SHA-1, SHA-384, SHA-512 and MD5, all generated locally on your device. Strong Password Generator Create cryptographically secure passwords with your rules — length, symbols, digits, upper/lowercase — plus a live strength meter. Generated on your device, never transmitted. UUID / GUID Generator Generate one or hundreds of RFC-4122 UUID v4 identifiers with formatting options. Uses your browser’s native crypto — instant and offline-capable. JWT Decoder Paste a JSON Web Token to inspect its header and payload, check expiry with readable timestamps, and verify structure — entirely on your device. MD5 Hash Generator Instant MD5 checksum of any text — private and free. SHA256 Hash Generator Secure SHA-2 hashes computed locally in your browser. File Hash Calculator Verify downloads: checksum any file without uploading it. JWT Generator (HS256) Build and sign test JWTs locally — secrets never leave your device. Htpasswd Generator Basic-auth credentials hashed right in your browser. AWS IAM Policy Generator Visual builder for AWS IAM policy JSON. CORS Header Generator Generate correct CORS headers for raw HTTP, Nginx, Apache or Express — no more preflight errors. Content Security Policy Generator Build a solid Content-Security-Policy header directive by directive, with output for any server. HSTS Header Generator Generate a correct Strict-Transport-Security header with safe max-age and preload guidance. OpenSSL Command Generator Build correct OpenSSL commands for certificates, CSRs, key pairs and conversions. security.txt Generator Publish a compliant security.txt so researchers can reach you about vulnerabilities. .env to Kubernetes Secret Generate Secret or ConfigMap YAML from a dotenv file

About these tools

Hashing is not encryption

A hash is one-way: it maps any input to a fixed-length digest and there is no operation to recover the input. That makes it right for verifying that a file or password matches, and wrong for anything you need to read back. Encryption is two-way and requires a key. MD5 and SHA-1 still have legitimate uses as checksums against accidental corruption, but they are broken for anything security-relevant — use SHA-256 or better there.

Reading a JWT

A JSON Web Token is three base64url segments: header, payload and signature. The first two are encoded, not encrypted, so anyone holding the token can read every claim inside it — which is exactly why you should never put anything private in a payload. Decoding locally shows you the claims and the expiry; verifying the signature is what proves the token was not altered, and that needs the key.

What actually makes a password strong

Length beats cleverness. Substituting a 3 for an E adds essentially nothing against a modern cracking dictionary, while adding four random characters multiplies the search space enormously. Real strength comes from randomness and length together, generated rather than invented, and stored in a password manager instead of reused — reuse is what turns one site's breach into every account you own.