Security Tools
Security tools that run entirely in your browser. Your passwords, keys, and tokens are never sent to any server. Everything is computed locally on your device.
Password Strength Checker
Analyse entropy and estimated crack time for any password, with specific improvement suggestions.
Password Generator
Generate cryptographically random passwords with full control over length and character sets.
Hash Generator (SHA-256/512)
Produce SHA-256 or SHA-512 cryptographic fingerprints from any text — instantly, no server.
Base64 Encoder / Decoder
Encode plain text or binary data to Base64, or decode Base64 strings back to readable text.
URL Encoder / Decoder
Percent-encode URL strings for safe transmission, or decode encoded URLs back to plain text.
JWT Decoder
Decode JWT header and payload, inspect all claims, and check whether the token has expired.
CIDR Subnet Calculator
Get network address, broadcast address, subnet mask, host range, and usable host count for any CIDR block.
UUID v4 Generator
Generate one or hundreds of cryptographically random UUID v4 strings — copy all with one click.
Secret Key Generator
Generate secure random keys in hex or base64 for use with HMAC, AES, JWT signing, and APIs.
HMAC Generator
Sign messages with HMAC-SHA256 or HMAC-SHA512 using a secret key — ideal for API signature verification.
Why Developers Need Security Tools
Security mistakes rarely announce themselves during development. A password stored without hashing, a JWT decoded without signature verification, a CIDR range miscalculated — these are the kinds of errors that create vulnerabilities discovered months later. The tools on this page automate the tedious math and encoding work that security-conscious development requires every day.
Standards Behind the Tools
Every tool here implements an established specification. Hash functions follow NIST FIPS 180-4 (SHA-2) and FIPS 202 (SHA-3). HMAC follows IETF RFC 2104. JWTs follow RFC 7519. Base64 follows RFC 4648. URL encoding follows RFC 3986. CIDR notation follows RFC 4632. Using tools built on these standards means your implementation aligns with what browsers, servers, and security auditors expect.
Client-Side Processing: What It Means for Security
All tools on this page process data in your browser — nothing is sent to a server. This is important for security-sensitive operations: your passwords, API keys, and tokens never leave your machine. You can verify this by checking your browser's network tab while using any tool. For maximum security when handling production secrets, use these tools on an air-gapped machine or within your own local network.
More Tool Categories