🔐Security
Security tools help you protect data and understand how cryptography works: hash generators and checkers, password strength, two-factor (TOTP) codes, classic ciphers and header checks. Everything is processed locally — your passwords and files never leave the browser.
58 tools
Password Generator
Generate strong, random passwords with custom length, uppercase letters, numbers and symbols. Generated in the browser — no data leaves your device.
Encrypt Text
Apply classic ciphers (Caesar, ROT13, Atbash) or Base64. Useful for puzzles, CTFs and testing — do not use for real security.
Password Strength Checker
Analyze the strength of any password: length, character classes, entropy in bits and resistance estimate. Processed in the browser — the password never leaves your device.
SQL Escape
Escape SQL strings by adding backslashes to single quotes and other special characters to prevent SQL injection.
Passphrase Generator
Generate strong, memorable passphrases made of random words. Easy to remember and hard to guess.
HMAC Generator
Generate HMACs (Hash-based Message Authentication Codes) with MD5, SHA-1, SHA-256, SHA-384, SHA-512 and SHA-3 algorithms.
Bcrypt Hash Generator
Generate secure bcrypt hashes from passwords and verify whether a password matches an existing bcrypt hash.
TOTP Code Generator (2FA)
Generate TOTP (Time-based One-Time Password) codes from a base32 secret, just like Google Authenticator. Useful for testing 2FA integrations without a phone.
File Hash (Checksum)
Calculate MD5, SHA-1, SHA-256, SHA-384 and SHA-512 of a file or text all at once. Perfect for verifying download integrity. Processed in your browser — no upload.
RSA Key Pair Generator
Generate RSA key pairs (public and private) of 2048 or 4096 bits directly in your browser. Useful for SSH, JWT, asymmetric encryption and certificates. No data sent to servers.
ROT13 Cipher
Apply the ROT13 cipher (rotate by 13 letters) to text. Applying twice returns the original. Used in forums to hide spoilers. Only A–Z and a–z are affected. Everything in your browser.
ROT47 Cipher
Apply the ROT47 cipher (rotation across 47 printable ASCII chars 33–126). Wider than ROT13: covers numbers and symbols. Applying twice returns the original. Everything in your browser.
Atbash Cipher
Apply the Atbash cipher (A↔Z, B↔Y, C↔X...): each letter is mirrored in the alphabet. Ancient Hebrew cipher used in the Bible. Applying twice returns the original. Everything in your browser.
Vigenère Cipher
Encrypt and decrypt text with the polyalphabetic Vigenère cipher using a keyword. More robust than Caesar by using multiple shifts. Everything in your browser.
BIP39 Mnemonic Generator
Generate BIP39 mnemonics of 12, 15, 18, 21 or 24 words (Bitcoin/Ethereum wallet standard). Words come from the official 2048-word list. Useful to test wallets. Everything in your browser.
JWT Builder (HS256)
Build a JWT by filling in header, payload and secret. HS256 signature computed in the browser via SubtleCrypto.
Content-Security-Policy Builder
Build a Content-Security-Policy header by adding directives (default-src, script-src, img-src, frame-ancestors) with predefined sources.
HIBP K-Anonymity Format
Explains the Have I Been Pwned k-anonymity flow: SHA-1 password, first 5 chars on GET, suffix returned.
Secure Token Generator
Generate cryptographically secure random tokens (alphanumeric, hex or base64) in your browser. Ideal for API keys, secrets, passwords and unique IDs.
CORS Config Validator
Validate a CORS configuration (allowed origins or *), checking the format and duplicates. Useful for safely configuring APIs and web servers.
Mixed Content Detector
Scans http:// references inside HTML served over HTTPS, flagging insecure assets and links.
Basic CSP Evaluator
Evaluates a Content-Security-Policy directive reporting unsafe-inline, unsafe-eval or wildcard issues.
HSTS Header Builder
Builds the Strict-Transport-Security header with max-age, includeSubDomains and preload as selected.
Referrer-Policy Builder
Builds the Referrer-Policy header from a standard value (strict-origin, no-referrer, etc.).
Permissions-Policy Builder
Builds the Permissions-Policy header from a list of feature=allowlist entries (e.g. geolocation=()).
COOP / COEP Headers Builder
Generate the COOP and COEP HTTP headers (Cross-Origin Opener/Embedder Policy) to isolate your origin. Required to safely use features like SharedArrayBuffer.
JWT Secret Strength
Measures the strength of an HMAC JWT secret: byte length, approximate entropy and rating.
Rail Fence Cipher
Encrypts messages with the Rail Fence (zigzag) cipher, spreading letters across N rails and reading rail by rail. A classic transposition cipher for learning cryptography.
Polybius Square Cipher
Encrypt and decrypt messages with the Polybius square, which turns each letter into a pair of digits on a 5×5 grid (with I and J combined).
Cifra Beaufort
Cifra Beaufort (variante simétrica da Vigenère).
Cifra Trifid
Cifra Trifid (Felix Delastelle) — codifica letras em triplas de 1-3.
Cifra ADFGVX (substituição)
Substitui cada letra pelo par ADFGVX correspondente em uma matriz 6×6.
Cifra Nihilist
Cifra Nihilist com chave numérica somada às coordenadas Polybius.
Cifra Vernam (One-Time Pad)
Cifra Vernam XOR byte-a-byte com chave de mesmo tamanho. Saída hex.
Bacon Cipher
Encodes text with the Bacon cipher, replacing each letter with a group of five As and Bs. Uses the modern 26-letter alphabet, keeping I and J apart.
A1Z26 Cipher
Converts text into numbers by each letter position in the alphabet (A=1, Z=26), separated by hyphens. A simple cipher popular in geocaching, escape rooms and logic puzzles.
Affine Cipher
Encode text with the Affine cipher using E(x) = (a·x + b) mod 26. Here uses a=5, b=8 (coprime with 26). Combines multiplicative and additive substitution.
Summarize CIDR Blocks to Supernet
Aggregate multiple IPv4 CIDR blocks into the smallest supernet that contains them all — free online tool for network admins.
Convert IP Range to CIDR List
Convert an IP range (start and end) into the smallest list of equivalent CIDR blocks. An essential tool for configuring firewalls, ACLs and network rules.
SPF Record Builder
Builds an SPF record step by step (ip4, ip6, include, mx, a, ~all, -all) and counts the terms that consume a DNS lookup, so you can compare against the limit of 10.
DMARC Record Builder
Create a DMARC record with policy (none/quarantine/reject), percentage, ruf/rua mailto and SPF/DKIM alignment.
Secure CSP Nonce Generator
Generate a 128-bit base64 random nonce for Content-Security-Policy with sample header and <script nonce> attribute.
Hill Cipher 2×2
Encrypt text with a 2×2 matrix mod 26 (Hill cipher) — algebraic explanation and key invertibility check.
Frequency Analysis to Break Ciphers
Count letter, bigram and trigram frequencies in ciphertext and compare with Portuguese/English references.
Index of Coincidence Calculator
Compute Index of Coincidence (IC) of ciphertext to distinguish mono/polyalphabetic ciphers — classic cryptanalysis tool.
Diceware Passphrase Generator
Generates a Diceware-style passphrase from a 7776-word list and shows entropy in bits.
Common Password Blacklist Check
Checks a password against the top 1000 most-used passwords, fully client-side, and flags it as compromised.
Password Crack Time Estimator
Estimates brute-force cracking time for a password in three scenarios (online, offline and GPU), from its length and character set. It does not check any leaked-password dictionary.
TOTP otpauth URI Builder
Builds an otpauth://totp/ URI with issuer, account, base32 secret, digits and period for QR code apps.
SAML Response Base64 Decoder
Decodes and indents base64-encoded SAMLResponse XML for inspection — useful for SSO debugging.
OAuth PKCE Pair Generator
Generate an OAuth 2.0 PKCE pair (code_verifier and SHA-256 code_challenge) for secure login flows in mobile apps and SPAs. Protect against code interception.
Email Header Analyzer
Analyzes a raw email header: Received server chain, per-hop delays, SPF, DKIM, DMARC results and spoofing warning signs.
Regex ReDoS Risk Analyzer
Analyzes a regular expression and flags ReDoS-prone parts, such as nested quantifiers and ambiguous alternation, without running it.
Shamir Secret Sharing (Split & Combine)
Splits a secret into shares with Shamir's scheme and rebuilds the original from the minimum number of shares. Runs in your browser.
Source Code Secret Scanner
Finds API keys, tokens, passwords and private keys pasted from code or .env files, by known pattern and by high entropy.
SSH auth.log Analyzer
Analyzes SSH auth.log files: failures per IP, targeted users, accepted logins, attack peaks and ready-to-copy block lists.
Password Policy Batch Auditor
Tests a list of passwords against the policy you define, showing which fail, which rules they break and the equivalent regex.
Typosquatting Domain Generator
Generates look-alike domains by swap, omission, keyboard slip, homoglyph, bitsquatting and other TLDs to monitor typosquatting.