Security & Crypto

Generate MD5, SHA-1, SHA-256, SHA-512, and SHA-3 hashes from text or files.

Generate strong, random passwords with configurable length and character sets.

Generate RFC 4122 UUIDs (v1, v4, v5, v7) individually or in bulk.

Check the strength of a password using entropy analysis and common patterns.

Hash and verify passwords using the bcrypt algorithm securely in the browser.

Generate HMAC signatures using SHA-256, SHA-512, or MD5 with a secret key.

Generate cryptographically secure random strings, tokens, and API keys.

Generate Universally Unique Lexicographically Sortable Identifiers (ULIDs).

Generate HTTP Basic Authentication headers from username and password.

Generate RSA public/private key pairs (2048/4096-bit) in PEM format using Web Crypto API.

Encrypt and decrypt text using AES-256-GCM with PBKDF2 key derivation — all client-side.

Generate BIP39 mnemonic seed phrases (12–24 words) for cryptocurrency wallets.

Paste a PEM certificate and decode its subject, issuer, validity, and SANs.

Enter a Base32 secret to see the current and next TOTP code, refreshed live.

Build a Content-Security-Policy header visually with per-directive source toggles.

Generate Subresource Integrity (SRI) hashes for CDN-hosted JS/CSS files.

Interactive step-by-step diagram of the OAuth 2.0 Authorization Code + PKCE flow.

Validate a card number's Luhn checksum, detect its network (Visa, Mastercard, Amex, etc.), and generate fake test numbers for sandbox use.

Validate an International Bank Account Number against the ISO 13616 checksum and see its country, check digits, and BBAN breakdown.

Validate a 17-character Vehicle Identification Number's check digit and decode its region, model-year code, and serial segment.

Generate URL-safe unique IDs in nanoid or CUID2-style format, with configurable length and batch count.

Generate a deterministic, SHA-1-based UUID v5 from a namespace and name — the same input always produces the same UUID.

Encode or decode text with a Caesar cipher shift (including ROT13), with all 25 possible shifts shown for brute-forcing an unknown key.

Compute the MD5, SHA-1, SHA-256, SHA-384, and SHA-512 hash of any file directly in your browser — nothing is uploaded.

Compute the standard CRC-32 (zlib/gzip/PNG/Ethernet) checksum of text or a file.

Generate a memorable, cryptographically random diceware-style passphrase from a curated word list, with an entropy estimate.

Convert between PEM-format public/private keys and JSON Web Key (JWK) format using the Web Crypto API, entirely client-side.

Paste raw HTTP response headers and get a checklist audit of common security headers like HSTS, CSP, and X-Frame-Options.

Encrypt or decrypt text with the classic Vigenère polyalphabetic cipher using a repeating keyword, with a letter-by-letter breakdown.

Encode or decode text with the Atbash cipher — a mirror-alphabet substitution (A↔Z, B↔Y...) that is its own inverse.

Encrypt text with a repeating-key XOR cipher and view the result as hex or Base64, with matching decryption back to plain text.

Generate a valid MongoDB ObjectId or decode an existing one to reveal its embedded creation timestamp, random value, and counter.

Decode Twitter/X or Discord-style Snowflake IDs into their embedded timestamp, worker/datacenter ID, process ID, and sequence number, with selectable epochs.

Build a Gravatar avatar image URL from an email address using a client-side MD5 hash, with configurable size, default image style, and content rating.

Encrypt and decrypt text with the classic Playfair digraph substitution cipher using a 5×5 key square built from your keyword, with the generated square shown.

Encrypt and decrypt text with the classic Rail Fence transposition cipher, writing letters in a zigzag across a configurable number of rails, with a visual diagram of the pattern.

Encrypt and decrypt text with the Affine cipher, a mathematical substitution cipher using the formula E(x) = (a·x + b) mod 26, with validation that key A is coprime with 26.

Encrypt and decrypt text with the Hill cipher, a classic polygraphic substitution cipher that multiplies pairs of letters by a 2x2 key matrix modulo 26.

Encrypt and decrypt text with the Beaufort cipher, a reciprocal Vigenère variant using the formula C = (K − P) mod 26, so the same operation both encrypts and decrypts.

Encode and decode the Tap Code, which represents each letter as a pair of knock counts on a 5x5 grid — historically used by prisoners of war to communicate through walls.

Encrypt and decrypt text with the Polybius square, an ancient Greek coordinate cipher that maps each letter to a row/column pair on a 5x5 grid.

Encrypt and decrypt letter pairs with the Four-Square cipher, a digraph substitution cipher using four 5x5 grids and two independent keywords.

Encrypt and decrypt text with the Bifid cipher, a fractionating cipher that converts letters to Polybius coordinates, recombines rows and columns, and reads new letters back out.

Encrypt and decrypt text with the Trifid cipher, Félix Delastelle's three-dimensional extension of Bifid using a 27-letter cube of coordinates.

Encrypt and decrypt text with the Caesar Box (Scytale) cipher, a transposition cipher that writes a message into a rectangle and reads it back column by column.

Convert letters into a mix of 1-digit and 2-digit codes using a straddling checkerboard, the classic technique later used as the message-to-digits step of the Cold War-era VIC cipher.

Encode and decode text with Francis Bacon's 1605 steganographic cipher, where every letter becomes a unique 5-character A/B sequence.

Encrypt and decrypt text with the WWI German ADFGX field cipher, combining a keyed Polybius square with a columnar transposition.

Encrypt and decrypt text with the 19th-century Nihilist cipher, which converts letters to Polybius-square coordinates and adds a repeating keyword before producing a numeric ciphertext.

Validate EAN-8, EAN-13, and UPC-A barcode check digits using the standard weighted-modulo-10 checksum, or compute the correct check digit for a partial code.

Encode text into the classic Pigpen cipher, rendering each letter as its traditional grid symbol — a tic-tac-toe grid for A-R (dotted for J-R) and an X-grid for S-Z (dotted for W-Z).

Paste a hash string and see the likely algorithm(s) it could be, based on its length, character set, and format (hex, Base64, bcrypt, or Argon2).

Generate an RFC 9116 compliant security.txt file with contact, expiry, encryption, policy and canonical fields, with validation warnings.

Calculate SHA256 and legacy SHA1 fingerprints from an SSH public key to verify it matches what GitHub, servers or ssh-keygen -l report.

Decode WebAuthn clientDataJSON, authenticatorData and attestationObject, inspect flags and credential public keys, or create a test passkey to see real values.

Verify a JWT signature in your browser with a secret, PEM public key, JWK or JWKS. Supports HS, RS, PS and ES algorithms through WebCrypto.

Inspect an ASCII-armored PGP public key: user IDs, algorithm, key size or curve, key ID and fingerprint — parsed locally in your browser.

Benchmark PBKDF2 iteration counts on your own device to pick a work factor, with OWASP guidance for PBKDF2, bcrypt, scrypt and Argon2id.

Decode and verify a DPoP proof (RFC 9449): header, htm/htu/iat/jti claims, ath hash and JWK thumbprint, with signature verification.

Check npm or PyPI package names against popular packages for typosquatting and dependency-confusion risk.

Identify ML-KEM, ML-DSA and SLH-DSA public keys by OID, check sizes against FIPS 203/204/205 and flag quantum-vulnerable keys.

Generate PublicKeyCredentialCreationOptions and RequestOptions for passkeys with secure defaults and a random challenge.

Generate a PKCE code verifier, S256 code challenge and a complete OAuth 2.0 / OIDC authorization URL.