Security
Create and check passwords, hash and sign data, and inspect tokens without sending anything anywhere. Check SPF, DKIM and DMARC for any domain. Web security tools are planned.
15 tools
Start here
Passwords & secrets
Create strong secrets and check existing ones.
- Password generatorGenerate strong, random passwords in your browser. Choose length and characters. Nothing is sent or stored.Generator
- Random token & API key generatorGenerate cryptographically secure random tokens in hex, Base64 URL-safe or alphanumeric. Useful for API keys, secrets and session IDs.Generator
- Password strength checkerEstimate how strong a password is, how long an offline attack could take and how to improve it. Checked locally, nothing is sent.Analyzer
Hashing & crypto
Hash, sign and verify. MD5 and SHA-1 are not safe for passwords.
- Hash generatorCreate SHA-1, SHA-256, SHA-384 or SHA-512 hashes from text, right in your browser. Handy for checksums and tests.Tool
- HMAC generatorCreate HMAC signatures with SHA-1, SHA-256, SHA-384 or SHA-512. Calculated locally, your key never leaves the browser.Tool
- Bcrypt hash generator & verifierCreate bcrypt password hashes with a chosen cost factor and verify a password against a hash. Runs locally in your browser.Tool
- Hash identifierFind out which algorithm a hash probably comes from: MD5, SHA-1, SHA-256, bcrypt, Argon2 and more, based on length and prefix.Analyzer
- X.509 certificate decoderDecode a PEM or DER X.509 certificate: subject, issuer, validity dates, public key, Subject Alternative Names and extensions.NewAnalyzer
Tokens & identity
Inspect tokens without sending them anywhere.
Email security
Check SPF, DKIM, DMARC and message headers. Look up live or paste records.
- SPF analyzerCheck an SPF record: lookup count against the limit of 10, include chain, -all vs ~all and risky IP ranges. Look it up in DNS or paste records.NewAnalyzer
- DMARC analyzerCheck a DMARC record: policy, subdomain policy, pct and report addresses, with a diagram of what receivers do. Look it up in DNS or paste records.NewAnalyzer
- DKIM checkerCheck a DKIM record for a selector: key type and length, testing mode and revoked keys. Look up selector._domainkey.domain in DNS or paste the record.NewAnalyzer
- Email header analyzerPaste email headers to see the delivery path, SPF, DKIM and DMARC results, and spot spoofing signs like a mismatched From domain.NewAnalyzer
- SPF record generatorBuild an SPF record from the IP ranges, includes, and A/MX records that send mail for your domain, with a live lookup count against the limit of 10.NewGenerator
- DMARC record generatorBuild a DMARC record with policy, subdomain policy, report addresses and alignment settings, ready to publish as a TXT record.NewGenerator
Nothing of this type here yet.
Web security Soon
Planned: CSP analyzer, security headers and cookie flags.
Becomes a section once it has at least 3 tools.
Threat modeling Soon
Planned: STRIDE threat model builder.
Becomes a section once it has at least 3 tools.