Security & Crypto Tools

Hash any text with MD5, SHA-1, SHA-256, SHA-384, or SHA-512 using the browser's Web Crypto API — nothing is ever uploaded.

Create crypto-safe passwords with a length slider, per-character-set toggles, and an ambiguous-character filter — all generated locally.

Generate one or many UUIDs — v4 (random), v1 (time-based), or v7 (time-ordered) — with bulk generation and copy buttons.

Build a JWT from a JSON payload and secret with HS256/384/512 signing — or paste a token to decode its payload. All local, no transmission.

Select a file and get its MD5, SHA-1, SHA-256, SHA-384, or SHA-512 checksum computed entirely in your browser.

Hash any text with MD5, SHA-1, SHA-256, SHA-384, or SHA-512 using the browser's Web Crypto API — nothing is ever uploaded.

Select a file and get its MD5, SHA-1, SHA-256, SHA-384, or SHA-512 checksum computed entirely in your browser.

Pick a file, paste the expected checksum, and instantly see whether they match — confirming the download is intact and untampered.

Generate HMAC signatures (SHA-256, SHA-384, SHA-512, SHA-1) for API request signing and webhook verification — your secret key never leaves the browser.

Compute the CRC-32 checksum (8 hex chars) of any text — the fast error-detection code used in zip, PNG, and network protocols.

Paste a hex digest and get likely algorithms based on its length — MD5 (32), SHA-1 (40), SHA-256 (64), SHA-512 (128) and more.

Paste two digests to check whether they're identical — case and whitespace ignored, so pasted hashes compare cleanly.

Generate one or many UUIDs — v4 (random), v1 (time-based), or v7 (time-ordered) — with bulk generation and copy buttons.

Paste any UUID to confirm it's well-formed and learn its version (v1–v8) and variant from the structure — useful for debugging IDs.

Generate NanoIDs — compact, URL-safe, collision-resistant IDs — with configurable length and bulk output.

Generate ULIDs (26-char, sortable, Crockford Base32 IDs) or paste one to decode the timestamp embedded in its first 10 characters.

Decode any Snowflake ID into its timestamp, worker, and sequence — or generate one with a custom epoch, worker, and sequence.

Create crypto-safe passwords with a length slider, per-character-set toggles, and an ambiguous-character filter — all generated locally.

Type a password to see its entropy, estimated crack time, a 0–4 strength score, and concrete feedback — computed entirely locally.

Generate 'correct horse battery staple'-style passphrases from a bundled 7776-word diceware list, with configurable word count and separator.

Generate crypto-safe random tokens in hex, Base64 URL, alphanumeric, or numeric form — ideal for API keys, session secrets, and CSRF tokens.

Build random strings with per-class toggles (lowercase, uppercase, digits, symbols) and a length slider — fully local and crypto-safe.

Get raw crypto-safe random bytes as hex or a random integer in [0, 999999] — backed by crypto.getRandomValues, never Math.random.

Generate cryptographically random salts (16+ bytes recommended) in hex or Base64 URL encoding for password hashing and key derivation.

Generate crypto-random numeric PINs (4–12 digits) with an optional no-repeated-digits rule for easier entry.

Enter a Base32 secret to see its live 6- or 8-digit TOTP code with countdown, and verify any code against the current step.

Build a JWT from a JSON payload and secret with HS256/384/512 signing — or paste a token to decode its payload. All local, no transmission.

Hash passwords with bcrypt (audited bcryptjs library, cost factor 4–15) or verify a plaintext password against an existing $2b$ hash.

Generate a 2048-bit RSA-OAEP key pair and export both keys as PEM — the private key never leaves your browser.

Encrypt text with AES-256-GCM (PBKDF2-derived key) or decrypt a ciphertext+IV pair — entirely in your browser, nothing transmitted.

Paste an API key to see which provider formats it matches (Stripe, OpenAI, GitHub, AWS, Google, and more) by prefix and length.

Hash any text with MD5, SHA-1, SHA-256, SHA-384, or SHA-512 using the browser's Web Crypto API — nothing is ever uploaded.

Select a file and get its MD5, SHA-1, SHA-256, SHA-384, or SHA-512 checksum computed entirely in your browser.

Pick a file, paste the expected checksum, and instantly see whether they match — confirming the download is intact and untampered.

Generate HMAC signatures (SHA-256, SHA-384, SHA-512, SHA-1) for API request signing and webhook verification — your secret key never leaves the browser.

Hash passwords with bcrypt (audited bcryptjs library, cost factor 4–15) or verify a plaintext password against an existing $2b$ hash.

Generate one or many UUIDs — v4 (random), v1 (time-based), or v7 (time-ordered) — with bulk generation and copy buttons.

Paste any UUID to confirm it's well-formed and learn its version (v1–v8) and variant from the structure — useful for debugging IDs.

Generate NanoIDs — compact, URL-safe, collision-resistant IDs — with configurable length and bulk output.

Generate ULIDs (26-char, sortable, Crockford Base32 IDs) or paste one to decode the timestamp embedded in its first 10 characters.

Decode any Snowflake ID into its timestamp, worker, and sequence — or generate one with a custom epoch, worker, and sequence.

Create crypto-safe passwords with a length slider, per-character-set toggles, and an ambiguous-character filter — all generated locally.

Type a password to see its entropy, estimated crack time, a 0–4 strength score, and concrete feedback — computed entirely locally.

Generate 'correct horse battery staple'-style passphrases from a bundled 7776-word diceware list, with configurable word count and separator.

Generate crypto-safe random tokens in hex, Base64 URL, alphanumeric, or numeric form — ideal for API keys, session secrets, and CSRF tokens.

Build random strings with per-class toggles (lowercase, uppercase, digits, symbols) and a length slider — fully local and crypto-safe.

Get raw crypto-safe random bytes as hex or a random integer in [0, 999999] — backed by crypto.getRandomValues, never Math.random.

Generate cryptographically random salts (16+ bytes recommended) in hex or Base64 URL encoding for password hashing and key derivation.

Enter a Base32 secret to see its live 6- or 8-digit TOTP code with countdown, and verify any code against the current step.

Build a JWT from a JSON payload and secret with HS256/384/512 signing — or paste a token to decode its payload. All local, no transmission.

Generate a 2048-bit RSA-OAEP key pair and export both keys as PEM — the private key never leaves your browser.

Encrypt text with AES-256-GCM (PBKDF2-derived key) or decrypt a ciphertext+IV pair — entirely in your browser, nothing transmitted.

Compute the CRC-32 checksum (8 hex chars) of any text — the fast error-detection code used in zip, PNG, and network protocols.

Paste a hex digest and get likely algorithms based on its length — MD5 (32), SHA-1 (40), SHA-256 (64), SHA-512 (128) and more.

Paste two digests to check whether they're identical — case and whitespace ignored, so pasted hashes compare cleanly.

Generate crypto-random numeric PINs (4–12 digits) with an optional no-repeated-digits rule for easier entry.

Paste an API key to see which provider formats it matches (Stripe, OpenAI, GitHub, AWS, Google, and more) by prefix and length.

Hash text or files with SHA3-256 or SHA3-512 — computed locally since Web Crypto doesn't support SHA-3 natively.

Generate Argon2 password hashes (Argon2id/i/d) with sensible Interactive/Sensitive presets and an advanced mode.

Verify a message signature against a public key using RSA-PSS or ECDSA via the Web Crypto API.

Paste a PEM certificate (or upload .crt/.pem) and see subject, issuer, validity, SANs, and fingerprint.

Generate an RSA SSH key pair locally — OpenSSH public key + PEM private key — with a clear trust warning.

Generate an armored PGP public + private key pair from a name, email, and passphrase — entirely in the browser.

Encrypt a message with a recipient's public key, or decrypt an armored message with your private key and passphrase.

Paste a JWT and see its header and payload as pretty JSON, with expiry status and an alg:none warning.

Hash text with a user-provided or auto-generated salt (SHA-256/SHA-512) — output includes the salt so it can be stored alongside.

Generate cryptographically random CSRF tokens, with copy-paste snippets for Express, Django, and Rails hidden fields.

An interactive two-party simulator showing how Diffie-Hellman derives a shared secret from public parameters.