Security Tools

Free online security tools — strong password generator, UUID generator, and more cryptographic utilities. All run in your browser — nothing sent to a server.

28 tools

Password Generator

Generate cryptographically strong random passwords with custom length, symbols, numbers and uppercase options. Nothing is sent to any server.

Password Strength

Score a password against what crackers actually try — wordlists, keyboard walks, leet spelling, dates — and see how long four attacks would take.

Passphrase Generator

Generate memorable passphrases using crypto.getRandomValues. 3–10 words, 5 separator styles, capitalize & digit options. Live entropy meter.

Entropy Calculator

Calculate password entropy in bits from a real password or a length-and-character-set policy, then compare crack times across four attack speeds.

API Key Generator

Generate random API-style key strings for tests, mock UIs and seed data with a chosen prefix, encoding (hex, Base64URL, alphanumeric) and length.

PIN Generator

Generate cryptographically secure PINs in numeric, alphanumeric, or hex mode. Choose length 4–16, batch up to 20 PINs, and group digits for readability.

Secret Key Generator

Generate 128–512-bit cryptographic secret keys in hex, Base64, Base64URL, or Base58 using crypto.getRandomValues. Batch up to 20 keys at once.

Password Checker

Check a password against 10 structural weakness patterns — length, common words, keyboard walks, l33t-speak, year patterns and more. Runs locally.

UUID v5

Build deterministic RFC 4122 v5 UUIDs from a namespace and a name with SHA-1. The same inputs always return the same ID, on any machine.

CSRF Token Generator

Generate a CSRF token plus the exact Set-Cookie line, hidden input, meta tag and request header for synchronizer or double-submit setups.

Also in Security

Tools from other categories tagged with Security

UUID Generator

Generate RFC 4122 compliant UUID v4 strings with one click, or batch-generate up to 100 unique IDs at once. Cryptographically random and free.

AES File Encryptor

Encrypt or decrypt any file with a passphrase using AES-256-GCM and PBKDF2 key derivation, entirely in your browser. Nothing is uploaded.

RSA Key Generator

Generate RSA key pairs (2048, 3072, 4096-bit) for encryption (OAEP) or signing (PSS) in PEM format using WebCrypto. Download or copy instantly.

ECDSA Key Generator

Generate ECDSA or ECDH key pairs on P-256, P-384, or P-521 in PEM or JWK format using WebCrypto. Private key blurred by default. Nothing uploaded.

Cert Decoder

Paste a PEM certificate and read its subject, issuer, validity dates, SANs, key algorithm and SHA-256 fingerprint. Decoded in your browser only.

CSR Generator

Generate a PKCS#10 CSR and matching private key in your browser. Supports RSA 2048/4096 and EC P-256/P-384. Nothing is uploaded or transmitted.

Suspicious URL Check

Read a link before you click it: decodes punycode, spots the @ trick, mixed-script homographs and brand-in-subdomain. The link is read, never fetched.

2FA QR Builder

Build the otpauth:// URI for a TOTP or HOTP account and render it as a scannable QR code. SHA-1/256/512, 6–8 digits, 30–90s period. Nothing uploaded.

TOTP Generator

Generate time-based one-time passcodes from a Base32 secret using RFC 6238, entirely in your browser. Configure the algorithm, digit count, and refresh period.

Card Validator

Validate any card number with the Luhn algorithm. Detects Visa, Mastercard, Amex, Discover and more. Shows IIN, CVC length, and formatted display.

Keystore Inspector

See which account a wallet keystore holds and how strong its scrypt or PBKDF2 work factor is. No password field, and nothing is ever decrypted.

BIP-39 Generator

Generate a BIP-39 mnemonic seed phrase from secure entropy, entirely in your browser. Choose 12 to 24 words and verify the checksum against the spec.

EIP-55 Checksum

Apply or validate the EIP-55 mixed-case checksum on any Ethereum address. Shows checksummed, lowercase, and uppercase forms with instant copy.

Random Numbers

Draw whole numbers from any range using your device's cryptographic random source, with unique-values mode and the modulo bias rejected rather than ignored.

Text Cipher

Encrypt and decrypt text using Caesar cipher, ROT13, Atbash, and Vigenère cipher. Includes adjustable shift, custom keyword, and instant swap.

Metadata Viewer

Read the EXIF hidden in a photo: camera, lens, shutter, ISO, capture date and GPS coordinates. The file is parsed in your browser and never uploaded.

JWT Decoder

Decode and inspect JSON Web Tokens. View header, payload, and signature. Detects expiry and maps all registered JWT claims.

PDF Unlocker

Remove the open password from a protected PDF and download the unlocked file. Decrypts entirely in your browser using pdf-lib — nothing is uploaded.

Why These Tools

Only one tool is filed under security outright, and the page pulls in three more that belong here by function: UUID Generator, JWT Decoder and Text Cipher. Strong Password Generator draws from crypto.getRandomValues rather than Math.random, which is the difference between a string that is genuinely unpredictable and one that only looks it. Weak Password Pattern Checker runs the other direction: paste any existing password and it checks it against 10 structural weakness patterns (common words, keyboard walks, l33t substitutions, year patterns and more), naming every flag and explaining why that pattern makes cracking easier. Nothing is transmitted anywhere for either tool. For shared vaults, breach alerts and real key management you want software built for the job.