Security tools

Check password strength with entropy scoring and crack-time estimates. See what makes a password weak or strong.

Generate HMAC signatures with SHA-256, SHA-384, or SHA-512. Enter message and secret key — runs in your browser.

Identify hash types from pasted digests. Detect MD5, SHA-256, bcrypt, and more. Paste only, runs in browser.

Validate IBAN numbers with mod-97 check digits. Paste an IBAN to verify format and checksum. Free browser tool.

Validate numbers with the Luhn algorithm. Check credit card and identifier check digits. Paste only, in browser.

Audit pasted JWT tokens for security issues. Flag alg none, expiry, and missing claims. Runs in your browser.

Paste two hashes and get a straight match or no match, instead of squinting at 64 hex characters and trusting your eyes.

Hash a file or a string with MD5, SHA-1, SHA-256 or SHA-512 and compare it against a published checksum to confirm the download arrived intact.

Paste a certificate and read the subject, issuer, validity window, subject alternative names and key details in plain text.

Generate an RSA key pair and the matching certificate signing request in your browser, with the private key never leaving the page.

Decode a PEM block and read what is inside it: certificate subject and dates, key parameters, or the fields of a signing request.

Paste a PEM certificate and see the not-before and not-after dates, plus how many days are left, before a renewal quietly slips past.

Open a Chrome extension file and read what is inside it: the manifest, every permission in plain English, and the full source of every file.