Small tools I built for everyday security chores. Each one runs in your browser. Nothing you type is sent anywhere.

  • Password and passphrase generator: Generate random passwords and passphrases in your browser, with an honest entropy figure. Nothing is sent or stored.
  • Hash identifier and file hasher: Guess a hash type from its format, and compute SHA-256, SHA-384 or SHA-512 of a local file with WebCrypto.
  • Encoder and decoder: Encode and decode base64, base64url, URL encoding, hex and HTML entities in your browser.
  • Security headers generator: Generate HTTP security headers for Cloudflare Pages, nginx, Apache and Caddy from one set of choices.
  • JWT decoder: Decode a JSON Web Token's header and payload in your browser and spot weak patterns such as alg none.
  • CSP analyzer: Paste a Content-Security-Policy and get a plain-language review of risky sources and missing directives.
  • security.txt generator: Generate an RFC 9116 security.txt file so researchers know how to report vulnerabilities to you.