Security & Privacy
Strengthen a memorable password, check for phishing and lookalike URLs, inspect suspicious files, audit SPF/DKIM/DMARC and HTTP security headers, check a server's live TLS configuration, encrypt files with AES-256, generate 2FA codes, decode JWTs and SSL certificates, analyze email headers, and generate secure tokens — all today, in your browser.
Showing 19 of 85 tools
AI Image Detector
Checks a photo for real, verifiable AI-generation signals — embedded C2PA Content Credentials, Stable Diffusion generation parameters, known AI-tool software tags, and camera EXIF — and says plainly when none are found, instead of guessing from pixels.
Try it nowEmail Header Analyzer
Paste raw email headers to trace the delivery path hop by hop, check SPF/DKIM/DMARC authentication results, and surface signals like From/Reply-To domain mismatches — entirely in your browser.
Try it nowEXIF Data Viewer & Remover
View a JPEG's embedded camera, exposure, date, and GPS location data, then download a cleaned copy with the EXIF, XMP, or IPTC metadata removed — without re-compressing the image.
Try it nowFile Encryption
Encrypt or decrypt any file with a password using AES-256-GCM and PBKDF2 key derivation, entirely in your browser — genuine authenticated encryption, not a toy cipher.
Try it nowHash Generator
Generate MD5, SHA-1, SHA-256, SHA-384, and SHA-512 hashes for text or a file simultaneously, then paste in a published checksum and let the tool detect which algorithm it matches and whether it's correct.
Try it nowHTTP Security Headers Analyzer
Fetch a URL's response headers and grade them against the OWASP Secure Headers baseline — CSP, HSTS, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy, and the Cross-Origin-* isolation headers — with a letter grade and a plain-English reason behind every point.
Try it nowJWT Decoder & Inspector
Decode a JWT's header and payload, interpret its expiration and issued-at claims, verify HS256/384/512 signatures against a secret, and get flagged for common security mistakes like alg:none — entirely in your browser.
Try it nowMemorable Password Strengthener
Type a word you already know you'll remember — a pet's name, a favorite place — and turn it into a strong password using look-alike character substitution (a→@, o→0, i→!, and more), with a plain-English breakdown of every change, a genuine entropy-based strength score, and an honest note if substitution alone isn't enough.
Try it nowPassword Generator
Generate strong, truly random passwords, memorable passphrases, or PINs — built on the Web Crypto API instead of Math.random(), with guaranteed character coverage, bulk generation, and a live strength meter.
Try it nowPassword Strength Checker
Get an honest strength score based on real entropy math and pattern detection (common passwords, sequences, keyboard walks), plus multi-scenario crack-time estimates and an optional, privacy-preserving breach check.
Try it nowPhishing & Lookalike URL Checker
Paste a URL to check it for the structural red flags real phishing links use: punycode/IDN homograph domains, brand names stuffed into a different domain, @-symbol host obfuscation, raw-IP hosts, shortened links, and commonly-abused TLDs.
Try it nowSecure Token / API Key Generator
Generate cryptographically secure random tokens in hex, Base64, Base64URL, or UUID v4 format using the browser's CSPRNG — for API keys, session secrets, and unique identifiers, with bulk generation and download.
Try it nowSign PDF
Create a signature by drawing it, typing it in a handwriting-style font, or uploading a photo of it, then drag it onto any page and save.
Try it nowSPF, DKIM & DMARC Record Checker
Look up a domain's SPF and DMARC records automatically, plus DKIM for a selector you provide, with plain-English validation: DNS lookup counts, policy strength, and the common misconfigurations that silently weaken email authentication.
Try it nowSSL/TLS Certificate Decoder
Paste a PEM-encoded certificate to see its subject, issuer, validity dates, serial number, public key details, and Subject Alternative Names — decoded by a hand-built ASN.1/X.509 parser, verified against Node.js's built-in certificate parser.
Try it nowSSL/TLS Configuration Checker
Connect live to a domain on port 443 to see which TLS protocol versions it accepts, the negotiated cipher, and full certificate details — issuer, expiry, trust status, and every domain it covers — from a real handshake, not a static lookup.
Try it nowSubresource Integrity (SRI) Hash Generator
Drop in a local JS or CSS file to get its sha256, sha384, and sha512 Subresource Integrity hashes, plus a ready-to-paste <script> or <link> tag — or fetch one from a URL if you don't have the file locally.
Try it nowSuspicious File Inspector
Drop in any file to check its actual magic bytes against its extension, detect embedded VBA macros in Office documents, scan PDFs for active-content triggers, and see its SHA-256 hash and entropy — a heuristic red-flag checker, not antivirus, and it says so plainly.
Try it nowTOTP / 2FA Code Generator
Generate real-time TOTP (Time-based One-Time Password) codes from a Base32 secret key — the same algorithm every authenticator app uses — with live countdown, algorithm/digit/period controls, and otpauth:// URI import, entirely in your browser.
Try it now