Security Tools

Generate role-based access control (RBAC) matrices for your application.

Encrypt and decrypt text with AES-256-GCM using a password (PBKDF2 key derivation), entirely in your browser. Strong, standard cryptography with zero uploads.

Scan text and code for exposed API keys and tokens, and respond correctly when one is found.

Generate and verify Argon2 password hashes.

Encode and decode Base64 in your browser, including URL-safe Base64 and UTF-8 text. Handles files and data URIs locally with nothing uploaded.

Encode and decode Base64 data.

Generate and verify bcrypt password hashes, with cost factors, the salt handling and bcrypt's known limitations.

Generate a BIMI DNS record, validate the logo and certificate requirements, and check the DMARC enforcement prerequisite that most failed deployments miss.

Calculate time to crack passwords with different protection mechanisms.

Track certificate expiry dates across an estate, see which are overdue for renewal against your alert thresholds, and get the renewal calendar and automation recommendations.

Convert CIDR notation to IP address ranges.

A new tool extracted from the codebase.

Check if a website is vulnerable to clickjacking.

Input a cloud issue (e.g. 'Public S3') to understand impact and remediation.

A new tool extracted from the codebase.

Work out why a CORS request is blocked and which response header the server is missing.

See SHA-256 hashing, AES-256-GCM encryption and RSA-OAEP key exchange run for real using the Web Crypto API. Interactive, local, nothing simulated.

Evaluate a Content Security Policy for the directives and bypasses that make it ineffective.

Decode a PEM certificate signing request and read its subject, key algorithm and size, subject alternative names and requested extensions before you submit it to a certificate authority.

Analyze forms and APIs for CSRF vulnerabilities and get remediation guidance.

Calculate CVSS v3.1 base, temporal and environmental scores from the metric vector, with the severity rating and the vector string for a ticket or advisory.

Look up a DKIM record by selector and check the key, syntax and common publication errors.

Check a DMARC record's policy, alignment mode and reporting addresses.

Generate a correct DMARC TXT record with policy, reporting address, percentage and alignment options, with rollout guidance.

Parse DMARC aggregate RUA XML reports into readable summaries: top sending IPs, pass/fail, alignment, and disposition.

Look up any DNS record type for a domain and understand what the answer actually tells you.

Score security findings with the DREAD model across damage, reproducibility, exploitability, affected users and discoverability, and rank a set of issues by their combined score.

Paste email headers to detect tracking bits, SPF, DKIM, and IP leaks.

Generate a fail2ban jail configuration with the right log paths, failure regex, ban times and ignore ranges for SSH, web servers, mail and application logs.

A new tool extracted from the codebase.

Generate MD5, SHA-1, SHA-256 and SHA-512 hashes in your browser. Compare checksums and verify file integrity with nothing uploaded to a server.

Identify what algorithm produced a hash from its length, character set and prefix. Covers MD5, SHA family, bcrypt, Argon2, scrypt, NTLM, PBKDF2 and the crypt formats.

Check which security headers a site sends, what each one defends against, and which are now obsolete.

Generate HMAC signatures with SHA-256 and other algorithms, and use them correctly.

Check a Strict-Transport-Security header against the browser preload list requirements, see what each directive commits you to, and get a staged rollout plan.

Generate htpasswd entries with bcrypt or other hashes for Apache and Nginx basic authentication.

View the HTTP headers returned by a URL.

Paste headers to see how they affect browser security features.

Classify security incidents by severity using industry-standard frameworks.

Find the geographical location of an IP address.

Build an iptables ruleset from a list of allowed services and sources, with stateful connection tracking, rate limiting, logging and a safe default deny policy.

Decode JWT header and payload, inspect claims and expiry, and spot common security flaws. Runs locally, your tokens are never transmitted.

Paste a JWT to decode its header and payload and flag security risks: alg none, jku/x5u header injection, missing expiry, millisecond timestamps and personal data in claims.

Look up a file hash against known-malware intelligence, and read the result correctly.

Generate cryptographically random single use recovery codes for multi factor authentication, with the hashing scheme they should be stored under and a policy checklist.

Generate the mta-sts.txt policy file and the _mta-sts DNS TXT record that tell sending mail servers to require TLS for your domain. Testing and enforce modes.

Generate Nano IDs, and compare their collision behaviour against UUIDs.

Build an Nmap command for an authorised scan of your own infrastructure, with the scan type, port selection, service detection, timing and output options explained.

Generate a cryptographically random PKCE code verifier and its S256 code challenge, plus a state parameter and nonce, with the full authorisation and token request they belong in.

Build the OpenSSL command you need for generating keys, creating certificate signing requests, self signing, converting formats and inspecting a live TLS endpoint.

Interactive checklist to assess your application against OWASP Top 10 vulnerabilities.

Generate strong, memorable passphrases from random words (diceware-style) with custom word count, separators, capitalization and numbers. Uses secure RNG. Private.

Measure password entropy in bits and see what that actually means for how long a password survives an attack.

Generate strong random passwords and passphrases in your browser using the Web Crypto API. Nothing is transmitted, logged or stored.

Choose bcrypt work factors, Argon2 memory and iteration parameters or PBKDF2 iteration counts from a target verification time, and see the attacker cost each setting imposes.

Check whether a password appears in known breach corpora, using k-anonymity so the password never leaves your device.

Analyze password policy text for entropy and compliance.

Measure password strength by entropy and pattern analysis rather than character-class rules. Checked entirely in your browser.

Analyze the strength and entropy of a password.

Check password strength with 8 security criteria, estimated crack time, and a secure random password generator with customization.

Paste raw email headers to trace the delivery path, read the SPF, DKIM and DMARC results, spot display name spoofing and header mismatches, and see where a message actually originated.

Simulate phishing scenarios to test security awareness and training effectiveness.

Redact common PII from text (emails, phone numbers, IPs, credit cards, PAN, Aadhaar) using local pattern matching.

Understand what attackers can see from your IP (ASN, headers, etc.).

Generate strong random passwords using the browser's cryptographic random source. Nothing is transmitted, logged or stored.

Generate random numeric PINs of any length using a cryptographic random source, avoiding the patterns that make PINs guessable.

Score your organisation across prevention, detection, backup integrity and recovery capability, and see which control gaps contribute most to the residual risk.

Look up the PTR record for an IP address, and understand why reverse DNS matters for mail delivery and bot verification.

Generate RSA public and private key pairs.

Decode a base64 SAML response or request, inflate a redirect binding payload, and inspect the issuer, conditions, attributes, signature location and timestamp validity.

A new tool extracted from the codebase.

A new tool extracted from the codebase.

Analyze HTTP security headers for any website. Check for HSTS, CSP, X-Frame-Options, and more with grading.

Build a complete set of HTTP security response headers from your requirements, and get the ready to paste configuration for Nginx, Apache, Cloudflare Workers or Express.

Generate a customer notification template for incidents with impact and time window.

Checklist-based tool to find common security misconfigurations in systems.

Validate your security.txt for required fields, formatting, and best practices. Helps you publish a correct disclosure policy file.

Paste the session ID before and after login, plus the Set-Cookie header, to check for session fixation, weak entropy and missing Secure, HttpOnly and SameSite flags.

Flatten an SPF record by expanding include: domains (manual paste). Shows approximate DNS lookup count.

Check an SPF record for syntax, lookup limits and the mistakes that cause mail to fail.

Paste an sshd_config and get an audit against current hardening guidance: authentication settings, cryptographic algorithms, access control and the defaults that matter more than what is written.

Compute the SHA-256 and MD5 fingerprints of an SSH public key, read its type and size, and verify it matches what a server or a colleague told you before you trust it.

Decode an X.509 certificate to read its subject, issuer, validity dates, SANs and key details. Parsed in your browser.

Calculate subnet masks, wildcard masks, and IP ranges.

Paste a sudoers file to find the entries that grant more than intended: NOPASSWD on shell capable binaries, wildcard command paths, ALL grants and the known GTFOBins escalation vectors.

Build a Berkeley Packet Filter expression from hosts, ports, protocols and TCP flags, with the full tcpdump command including rotation, snap length and output options.

Guide users through STRIDE threat modeling process for applications.

Decode a TLS cipher suite name or hex code into its key exchange, authentication, bulk cipher and MAC components, with a security assessment and the OpenSSL and IANA equivalents.

Estimate the entropy of an API key, session token or UUID, excluding fixed vendor prefixes, with recognised formats scored by their real random portion and guess times at realistic attack rates.

Generate TOTP codes from a secret and understand why they drift, expire and occasionally fail.

Generate the ufw commands to allow, deny, rate limit and delete rules, with a safe ordering that keeps SSH reachable and a rollback plan for remote hosts.

Generate ULIDs, which sort chronologically while remaining globally unique.

Encode and decode URLs and query parameters with correct percent-encoding. Handles UTF-8, component vs full-URI encoding, and double-encoded strings.

Analyse a URL's structure for phishing traits: IP hosts, punycode, @ tricks, brand names in subdomains, risky TLDs, shorteners and executable downloads. No lookups, runs locally.

Verify webhook signatures from Stripe, GitHub and other providers, and diagnose mismatches.

A new tool extracted from the codebase.

Encode XSS payloads for security testing (educational purposes only).

Build a YARA rule from strings, hexadecimal patterns and file characteristics, with correct modifiers, a condition clause and the metadata a shareable rule needs.