Security & crypto tools
Hashes, ciphers, JWTs, passwords, keys and threat-intel helpers — everything runs offline in your browser.
AES cipher
Encrypt or decrypt text with AES in CBC, CTR, GCM or ECB mode and 128/192/256-bit keys, with hex/base64 I/O — in your browser. Nothing is uploaded.
AES Key Wrap
Wrap and unwrap cryptographic keys with AES Key Wrap (KW / RFC 3394, KWP / RFC 5649) using a 128/192/256-bit KEK — hex or base64, free and in-browser.
Age encrypt
Encrypt small text into an ASCII-armored age ciphertext with a passphrase or native X25519 recipients.
Age Key Generator
Generate an age X25519 identity and its shareable age1 public recipient in your browser, or derive the recipient from an identity you already have.
Amcache Parser
Parse Windows Amcache.hve bytes from hex or Base64 and report application, executable, driver, shortcut, SHA-1 hash and timestamp evidence locally.
Argon2 hash
Hash a password with Argon2id (configurable memory, iterations, parallelism) and get a PHC string, or verify a password — in your browser. Nothing is uploaded.
ASN.1 / DER parser
Parse an ASN.1 / DER hex string into a readable tree of tags, lengths, OIDs and values — free, in your browser. Inspect X.509 certificates, keys and CSRs.
Strip Audio Metadata
Remove ID3 tags, comments, chapters, and cover art from MP3, FLAC, OGG, M4A, WAV, and other audio files in your browser. Stream-copy audio, no upload.
AWS Signature V4 Signer
Generate AWS SigV4 canonical requests, strings to sign, signatures, and Authorization headers locally for S3, IAM, and AWS APIs.
Bcrypt hash
Hash a password with bcrypt at a chosen cost and get a $2b$ hash string, or verify a password against an existing bcrypt hash — in your browser. Nothing is uploaded.
BIP39 Mnemonic Seed Phrase Generator
Generate a BIP39 mnemonic seed phrase (12–24 words) with checksum and derived 512-bit seed, entirely in your browser. Optional passphrase. Free and private.
BIP39 Seed Derivation
Derive the 512-bit BIP39 seed from an existing mnemonic recovery phrase and optional passphrase, in your browser. Validates the wordlist and checksum. Free and private.
Bitcoin Address Tool
Derive Bitcoin P2PKH, P2SH-P2WPKH, P2WPKH addresses and WIF from a secp256k1 private key. Supports hex or WIF input, mainnet and testnet.
Blowfish cipher
Encrypt or decrypt data with the Blowfish cipher in ECB or CBC mode, with hex/base64 I/O — in your browser. Variable 4–56 byte key. Nothing is uploaded.
Bot Traffic Filter
Paste an access log or user-agent list, flag and strip bot/crawler hits, and see the human-versus-bot split by category. Runs in your browser.
Validate a PEM certificate chain offline
Check a pasted PEM certificate chain offline for leaf-to-root ordering, signature linkage and expiry windows.
ChaCha20 cipher
Encrypt or decrypt text with ChaCha20 or ChaCha20-Poly1305 AEAD (RFC 8439) in your browser — 32-byte key, 12-byte nonce, hex/base64 I/O. Nothing is uploaded.
Checksum Calculator
Compute and verify CRC-32, CRC-32C, CRC-16, or CRC-8 checksums for text, hex, or base64 bytes, with hex or decimal output.
CipherSaber-2 cipher
Encrypt and decrypt CipherSaber-2 (RC4 with a 10-byte IV and repeated key setup) in your browser — hex or base64 output. Free, private, nothing uploaded.
Classical Cipher Tool
Encrypt and decrypt Caesar, Vigenère, Atbash, and rail-fence ciphers in your browser, with a Caesar brute-force listing all 26 shifts. Free and private.
AES-CMAC Generator
Generate an AES-CMAC (NIST SP 800-38B / RFC 4493) of any message and key in your browser — AES-128/192/256 by key length, hex or base64 output. Free and private.
CSV PII redactor
Mask, salted-hash, or redact the values in chosen CSV columns for safe sharing — pick columns by name or index, in your browser. Free, private, no upload.
Decode/Transform Recipe Pipeline
Chain byte-level decode/transform steps — Base64, hex, URL, gzip/zlib, XOR, ROT13 — into one recipe, applied top to bottom. Free, private, runs entirely in your browser.
Data anonymizer
Anonymize a CSV in your browser: redact identifier columns, generalize quasi-identifiers into bins, and get a k-anonymity report. Free, private, no upload.
DES cipher
Encrypt or decrypt data with single DES in ECB or CBC mode, with hex/base64 I/O — in your browser. For legacy interop. Nothing is uploaded.
Diceware Passphrase Generator
Generate memorable diceware passphrases from the EFF wordlists in your browser — with entropy bits, crack-time estimates, separators and extras. Free and private.
ECDSA secp256k1 sign & verify
Generate secp256k1 keypairs and sign or verify messages with ECDSA (the Bitcoin/Ethereum curve). RFC 6979 deterministic, DER + compact — in your browser.
ECDSA sign
Sign a message with an ECDSA private key (NIST P-256 or P-384) and get a DER or raw r||s signature in base64 and hex, in your browser. Nothing is uploaded.
ECIES encrypt/decrypt
Encrypt or decrypt ECIES payloads with secp256k1, P-256, or P-384 keys, HKDF-SHA256, AES-GCM/XChaCha20, and hex/base64/PEM inputs.
Ed25519 sign & verify
Sign a message with an Ed25519 private key, or verify a signature with the public key — hex, base64, or PEM keys, entirely in your browser.
Email Phishing Link Scanner
Paste an email and rate every link: display text vs real target, lookalike and punycode domains, bare-IP hosts, shorteners and redirect wrappers. Runs locally.
EVP_BytesToKey — OpenSSL key & IV derivation
Reproduce OpenSSL's EVP_BytesToKey key and IV derivation from a password and salt (MD5, SHA-1, SHA-256, SHA-512) — free and entirely in your browser.
Extract Hashes
Pull every MD5, SHA-1, SHA-256 and SHA-512 hash out of any text, grouped by algorithm and deduplicated — in your browser. Nothing is uploaded.
Fernet token tool
Create and read Fernet tokens (AES-128-CBC + HMAC-SHA256) in your browser: generate a key, encrypt to a url-safe token, decrypt with optional TTL. No upload.
HOTP generator
Generate counter-based one-time (HOTP, RFC 4226) codes from a base32 secret and a counter, in your browser. The secret never leaves your device.
GOST Kuznyechik cipher
Encrypt or decrypt text with the GOST Kuznyechik cipher (GOST R 34.12-2015) in CBC, CTR, CFB, OFB or ECB mode — 256-bit key, hex/base64 I/O, in your browser.
GOST Magma cipher
Encrypt or decrypt text with the GOST 28147-89 Magma 64-bit block cipher — ECB or CBC, 256-bit key, hex or base64 — free and entirely in your browser.
GPX Privacy Scrubber
Scrub a GPX file before sharing it: remove or fuzz start/end locations, rewrite timestamps, and strip sensor extensions. Runs locally in your browser.
Hash All Generator
Hash text with every common algorithm at once — MD5, SHA-1, SHA-256/512, SHA-3, BLAKE3, RIPEMD-160, CRC-32 and more — free and private in your browser.
Hash Identifier
Paste a hash and instantly identify its likely algorithm — bcrypt, Argon2, MD5, SHA-1/256/512, NTLM, sha512crypt, PHPass and more. Runs entirely in your browser.
Hash IOC Matcher
Hash text, hex or base64 content and match its MD5/SHA-1/SHA-256/SHA-512 against a pasted blocklist of known-bad IOC hashes. Free, private, in-browser.
Text Hash Generator
Generate MD5, SHA-1, SHA-256/512, SHA-3, BLAKE2 or BLAKE3 hashes of any text in your browser, with hex or base64 output. Free, private, nothing uploaded.
BIP32 HD Key Derivation
Derive BIP32 child private keys, xpubs, WIF keys, and Bitcoin mainnet/testnet P2PKH or SegWit addresses from a seed or xprv. Private and offline in your browser.
HKDF key derivation
Derive keys with HKDF, the HMAC-based extract-and-expand KDF from RFC 5869 — choose hash, salt, info label, length and hex/base64 output, all in your browser.
HMAC Generator
Generate an HMAC of any message and secret key in your browser — HMAC-SHA256, SHA-1, SHA-512, SHA-3 or MD5, hex or base64 output. Free and private.
HMAC Verify
Verify an HMAC tag against a message and secret key using a timing-safe comparison. Supports SHA-256, SHA-512, SHA-1, MD5, hex, and base64.
Index of Coincidence Calculator
Calculate the Index of Coincidence (IC) of any text — spot monoalphabetic vs polyalphabetic ciphers and estimate a Vigenère key length. Free, in your browser.
Defang / Refang IOCs
Defang or refang IOCs in your browser: turn http://evil.com into hxxp[://]evil[.]com so URLs, IPs, domains and emails are safe to share. Free, private.
IOC Extractor
Extract IOCs from threat reports in your browser — IPs, URLs, domains, emails, MD5/SHA hashes — with defanged (hxxp, [.]) input support. Free, private, no sign-up.
IP Log Anonymizer
Anonymize IPv4 & IPv6 addresses in a log in your browser: GA/Matomo-style masking, salted SHA-256 pseudonyms, or fixed redaction. Ports & timestamps kept. Free, private.
JA3 Fingerprint Calculator
Compute the JA3 and JA3N fingerprints (string + MD5 hash) of a TLS ClientHello from pasted hex, GREASE removed — free and local in your browser.
JA4S Fingerprint Calculator
Compute a JA4S server fingerprint from a TLS ServerHello in hex — the JA4+ server hash of version, ALPN, cipher, and extensions. Nothing is uploaded.
JWK Thumbprint
Compute the RFC 7638 SHA-256 thumbprint of a JSON Web Key — the canonical kid — in your browser. Supports RSA, EC, OKP, and oct keys. Nothing is uploaded.
JWT Claims Diff
Decode two JWTs offline and see exactly which claims were added, removed or changed — with human-readable expiry deltas. Nothing leaves your browser.
JWT decode
Decode any compact JSON Web Token (JWT) offline to inspect its header, payload claims, signature, and time-based validations. No data leaves your device.
JWT sign
Sign a JSON Web Token (JWT) from a payload with HS256/384/512, RS256/384/512 or ES256/384 in your browser. The secret and key never leave your device.
JWT verify
Verify a JWT signature (HS256/384/512, RS256/384/512, ES256/384) and its exp, nbf, iss and aud claims in your browser — token and key never leave your device.
Keccak-256 Hash Generator
Compute the original Keccak-256 or Keccak-512 hash of any text in your browser — the exact hash Ethereum uses, not FIPS SHA-3. Free and private.
Key derivation function
Derive a key of any length from a passphrase or seed with PBKDF2, scrypt, Argon2id, or HKDF — hex or base64, in your browser. Nothing is uploaded.
Luhn Check Digit Calculator
Compute the Luhn (mod-10) check digit for a partial number and get the completed, valid number — instantly, in your browser. Nothing is uploaded, free.
Luhn Validator
Validate a credit card, IMEI, or any number against the Luhn check-digit algorithm — instantly, in your browser. Nothing is uploaded, free.
LZNT1 Decompress
Decompress LZNT1 (Windows RtlCompressBuffer) blobs from hex or Base64 in your browser — registry hives, hiberfil, malware configs. Free, private, no sign-up.
Memory Strings Extractor
Extract ASCII and UTF-16LE strings from a memory or process dump, then group URLs, IPs, emails, domains, file paths and registry keys locally.
Metadata Privacy Linter
Scan image metadata for privacy leaks before sharing: GPS, serial numbers, owner names, timestamps, software, descriptions and keywords. Browser-local, no upload.
NaCl crypto_box encrypt/decrypt
Encrypt or decrypt NaCl crypto_box messages with Curve25519 keys, XSalsa20-Poly1305 authentication, and hex/base64 inputs. Free, local, and browser-based.
NaCl Secretbox encrypt/decrypt
Encrypt or decrypt NaCl secretbox data with a 32-byte shared key and 24-byte nonce. Free, local, and browser-based.
Sign a Nostr event locally
Build a Nostr event from content, tags and kind, sign it from an nsec or hex secret key, and copy publish-ready JSON. Runs locally in your browser.
NT / NTLM Hash Generator
Generate the NT (NTLM) hash of a password — MD4 of its UTF-16LE encoding — instantly in your browser. Hex or base64 output. Free, private, nothing uploaded.
Decode otpauth-migration exports
Decode an otpauth-migration export payload into standard otpauth provisioning URIs, offline.
otpauth:// URI generator
Build an otpauth:// provisioning URI (TOTP/HOTP) from an issuer, account, and base32 secret to set up any authenticator app. The secret stays in your browser.
otpauth:// URI parser
Paste an otpauth:// provisioning URI and see its type, issuer, account, base32 secret, algorithm, digits, and period or counter. Runs in your browser.
Password Strength Checker
Estimate a password's entropy in bits and crack time, and flag weaknesses — entirely in your browser. Your password is never sent anywhere, free.
Password export converter
Convert a password manager export between Bitwarden JSON/CSV, KeePass CSV, LastPass CSV and Chrome CSV. Keeps TOTP secrets and folders. Runs in your browser.
Password Generator
Generate strong random passwords or passphrases with configurable length, character sets, and word count — entirely in your browser, nothing uploaded, free.
Payment QR Generator
Build validated payment URIs and render scannable SVG QR codes for Bitcoin BIP21, Litecoin, Dogecoin, Ethereum, Lightning invoices or plain text.
PBKDF2 key derivation
Derive a key from a password with PBKDF2-HMAC (SHA-1/256/512). Pick iterations, salt, length and hex/base64 output — all in your browser. Nothing is uploaded.
Split PEM bundles into labeled blocks
Split concatenated PEM bundles into ordered, labeled blocks with type summaries, DER byte counts, suggested filenames, and optional SHA-256 fingerprints.
PEM ⇄ DER Converter
Convert keys, certificates and CSRs between PEM (base64 text) and DER (binary, shown as hex or base64) in either direction. Runs in your browser, nothing uploaded, free.
PEM Inspector
Decode PEM certificates, CSRs, and public/private keys in your browser. See subject, issuer, validity, SANs, key size, and fingerprints. No upload.
Extract Public Key from a Private Key
Derive the public key from an RSA, EC (P-256/P-384) or Ed25519 private key as a PEM public-key block. Free, in your browser — nothing is uploaded.
PEM → JWK converter
Convert a PEM-encoded RSA or EC key into a JSON Web Key (JWK), in your browser. Nothing is uploaded.
PGP decrypt
Decrypt a PGP message online with your private key or the password it was encrypted with. Verifies embedded signatures, handles binary payloads, runs in your browser.
PGP key info
Inspect an ASCII-armored PGP public or private key locally: fingerprint, key ID, algorithm, user IDs, dates, and subkeys.
PGP verify
Verify a PGP signature online — detached or clearsigned — against a message and public key; reports validity and signer key ID. Runs in your browser.
PII Tokenizer
Replace emails, phones, IPs, cards and SSNs with deterministic, format-preserving tokens. Same value maps to the same token, so data stays linkable. No upload.
PKCS#12 Inspector
Inspect a .p12/.pfx keystore offline: cert bags, key bags, friendly names, local key IDs, PBE and MAC parameters. No password needed, nothing uploaded.
Pronounceable Password Generator
Generate pronounceable, easy-to-type passwords from consonant/vowel phonemes with length, capitalization, digit, and symbol controls.
QR Paper Backup
Encode text or pasted file bytes into a printable SVG sheet of numbered QR codes with restore instructions and checksummed chunk metadata.
Rabbit cipher
Encrypt or decrypt text with the Rabbit stream cipher (RFC 4503 / eSTREAM) — 128-bit key, optional 64-bit IV, hex or base64. Free, in-browser, no upload.
Random Token Generator
Generate cryptographically secure random tokens, API keys, and secrets with a configurable length and character set — entirely in your browser, nothing uploaded, free.
RC2 cipher
Encrypt or decrypt with the RC2 block cipher (RFC 2268) in ECB or CBC mode, configurable effective key bits, hex or Base64 output — in your browser.
RC4 cipher
Encrypt or decrypt text with the RC4 stream cipher — optional drop-N to skip weak keystream bytes, hex or base64 output — free and in your browser.
RC6 cipher
Encrypt or decrypt data with RC6-32/20 in ECB or CBC mode with hex/base64 I/O — in your browser. For interop, learning, and CTFs. Nothing is uploaded.
Redact PII
Detect and redact PII (emails, phone numbers, IPs, credit-card and SSN numbers) in text, in your browser. Nothing is uploaded.
Registry Hive Parser
Parse offline Windows registry hive bytes from hex or Base64, inspect regf header integrity, browse keys and values, and sweep Run/RunOnce autostart locations locally.
RNCryptor v3 encrypt
Encrypt text or bytes into the password-based RNCryptor v3 container format, or verify and decrypt one, with base64/hex input and output.
RSA Decrypt
Decrypt RSA ciphertext with a PEM private key using OAEP or PKCS#1 v1.5 padding. Supports base64/hex input and UTF-8/hex/base64 output.
RSA encrypt
Encrypt a short message to an RSA public key (OAEP or PKCS#1 v1.5, SHA-256/384/512) and get base64 ciphertext, in your browser. Nothing is uploaded.
RSA sign
Sign a message with an RSA private key (PKCS#1 v1.5 or PSS, SHA-256/384/512) and get a base64 signature, in your browser. Nothing is uploaded.
RSA verify
Verify an RSA signature (PKCS#1 v1.5 or PSS, SHA-256/384/512) over a message against an RSA public key, in your browser. Nothing is uploaded.
SafeLink Decoder
Decode Outlook SafeLinks, Proofpoint URLDefense (v2/v3), Google redirects and ?url= wrappers to reveal the real destination. In-browser, no fetch, free.
Salsa20 cipher
Encrypt and decrypt with the Salsa20 stream cipher in your browser — 16/32-byte key, 8-byte nonce, hex or base64 output. Free, private, nothing uploaded.
SBOM Diff
Diff two package-lock.json, Cargo.lock, requirements.txt, or CycloneDX/SPDX SBOMs and see added, removed, and version-bumped dependencies. Runs locally in your browser.
SBOM Generator
Generate CycloneDX or SPDX SBOMs from package-lock.json, Cargo.lock, or requirements.txt. Runs locally in your browser.
scrypt key derivation
Derive a key from a password with the scrypt memory-hard KDF (RFC 7914). Set N, r, p, salt and hex/base64 output — free and fully in-browser.
secp256k1 Public Key Derivation
Derive the secp256k1 public key from a private key: compressed (02/03) and uncompressed (04) SEC1 points, plus X and Y coordinates. Hex or WIF input, all in your browser.
Secret scanner
Paste code or config and flag hardcoded secrets — AWS, GitHub, Stripe, Google and other API keys, plus private-key headers. Runs in your browser, nothing uploaded.
SHA-1 Hash Generator
Generate a SHA-1 hash of any text in your browser — hex or base64 output, uppercase option, hex/base64 input decoding. Free, private, nothing uploaded.
SHA-256 Hash Generator
Generate a SHA-256 (SHA-2) hash of any text instantly in your browser — hex or base64 output, uppercase option. Free, private, nothing is uploaded.
SHA-3 Hash Generator
Compute the FIPS-202 SHA-3 hash (SHA3-256/384/512) of any text in your browser — the NIST standard, not Keccak. Hex or base64 output. Free, private, no sign-up.
Shamir Secret Recover
Paste Shamir shares to recover a secret locally, with GF(256) format detection, threshold checks and redundant-share verification.
Shellbags Parser
Parse Windows shellbags from a registry hive pasted as hex or Base64: walk BagMRU, decode shell items and rebuild the folder paths a user browsed, deleted ones included.
Sigma rule matcher
Run Sigma detection rules against parsed Windows event JSON, filter by severity/status, and return report, table or JSON detections.
SM2 public key from private key
Derive an SM2 public key from a private key (GM/T 0003, curve sm2p256v1) — hex scalar or PKCS#8 PEM in, SEC1 hex and SPKI PEM out. In-browser, no upload.
SM4 cipher
Encrypt or decrypt data with the SM4 block cipher (GB/T 32907) in ECB or CBC mode, with hex/base64 I/O — in your browser. 128-bit key. Nothing is uploaded.
SOPS-style config encryption
Encrypt or decrypt YAML, JSON and .env values with a passphrase. Keys stay readable, the file stays valid, and diffs still show what changed.
SQL injection scanner
Paste code and flag SQL built by string concatenation, f-strings, or format calls instead of bound parameters. Runs in your browser, nothing uploaded.
SSH Config Formatter
Pretty-print ~/.ssh/config with canonical keywords and consistent indent, then flag duplicate hosts, shadowed blocks, unknown keywords and bad values.
Get the SSH Public Key from a Private Key
Derive the OpenSSH public key (id_*.pub line) from an RSA, ECDSA (P-256/P-384) or Ed25519 private key. Runs in your browser, nothing uploaded, free.
SSH Public Key Parser
Paste an OpenSSH public key, authorized_keys or known_hosts line and read its algorithm, bit size, comment and SHA256/MD5 fingerprints — free, in your browser.
Text encrypt
Encrypt or decrypt text with a passphrase using AES-256-GCM, in your browser. Get a copy-pasteable token. Nothing is uploaded.
LLM Token Counter & Cost Estimator
Paste text to count LLM tokens with real tiktoken BPE, then estimate the prompt cost and context-window usage for GPT, Claude, and Gemini. Free, private, in-browser.
TOTP generator
Generate time-based one-time (2FA) codes from a TOTP secret, in your browser. The secret never leaves your device.
TOTP Secret Setup Generator
Generate a fresh base32 TOTP secret and otpauth enrollment URI for authenticator apps — local, random, and copy-ready.
URL Safety Inspector
Paste a URL to rate phishing risk from structural heuristics: IP hosts, @ tricks, deep subdomains, punycode and lookalike TLDs. Runs locally.
USN Journal Parser
Parse an NTFS $UsnJrnl:$J change journal from hex or Base64 and list file create, rename, write and delete events with UTC timestamps, locally.
Checksum Verifier
Verify text or data against an expected checksum — auto-detects MD5, SHA-1, SHA-256, SHA-3, BLAKE2 or BLAKE3 from digest length. Free, private, in-browser.
Blur or Pixelate a Region in a Video
Blur or pixelate a fixed rectangle — a license plate, name tag or logo — on every frame of a video, right in your browser. Nothing is uploaded, runs locally, free.
Strip Video Metadata
Remove GPS, device, timestamp, title, comment, stream, and chapter metadata from a video locally with ffmpeg stream copy — no upload and no re-encode.
Weak Password Detector
Check whether a password is one of the most common or breached passwords. Detects case and leetspeak variants, offline in your browser — nothing is uploaded.
WireGuard Key Generator
Generate WireGuard private, public and preshared keys locally, with a ready-to-paste wg0.conf snippet and JSON export.
X25519 ECDH key agreement
Derive an X25519 (Curve25519) ECDH shared secret from your private key and a peer public key, then expand it with HKDF-SHA256/512. Runs in your browser.
XOR cipher
XOR text, hex, or Base64 data against a repeating key and output hex, Base64, or UTF-8. Symmetric encrypt/decrypt in your browser.
Derive addresses from an extended public key
Derive receive and change Bitcoin addresses from an xpub, ypub, zpub, tpub, upub, or vpub. Watch-only, offline, and private in your browser.
YouTube Takeout stats
Parse Google/YouTube Takeout watch-history JSON or HTML into top channels, repeated videos, monthly trends, weekdays, hours, streaks, CSV, and JSON.