🔐Security
Security tools help you protect data and understand how cryptography works: hash generators and checkers, password strength, two-factor (TOTP) codes, classic ciphers and header checks. Everything is processed locally — your passwords and files never leave the browser.
98 tools
Cookie __Secure-/__Host- Prefix Validator
Validate Set-Cookie headers against __Secure- and __Host- prefix rules from RFC 6265bis (Secure, Domain, Path).
Secure CSP Nonce Generator
Generate a 128-bit base64 random nonce for Content-Security-Policy with sample header and <script nonce> attribute.
CSP Hash Generator for Inline Scripts
Generate the SHA-256/384/512 base64 hash of an inline script to allow it in your Content-Security-Policy (CSP) without using a nonce. Harden your site security.
Clear-Site-Data Header Builder
Build a Clear-Site-Data header (cache, cookies, storage, executionContexts) — useful on logout to wipe origin data.
Cache-Control Security Check
Analyse Cache-Control and warn when sensitive content may be cached by proxies (missing no-store, private, etc.).
X-Content-Type-Options Header Check
Confirm X-Content-Type-Options is set to nosniff and explain MIME-sniffing risks when the header is missing.
X-Frame-Options vs frame-ancestors Compare
Compare X-Frame-Options with the CSP frame-ancestors directive and detect conflicts or redundancy for clickjacking.
CORS Preflight Explainer
Given a CORS request method and headers, shows whether it triggers an OPTIONS preflight and explains why.
Trusted Types Policy Builder
Generate CSP require-trusted-types-for and trusted-types directives with policy names — a modern anti-XSS mitigation.
Network Error Logging (NEL) Builder
Build NEL and Report-To headers to send network error reports to your own endpoint with sampling fractions.
Playfair Cipher Step by Step
Encrypt/decrypt with Playfair showing the 5×5 matrix, letter pairs and the rule applied to each digram.
Hill Cipher 2×2
Encrypt text with a 2×2 matrix mod 26 (Hill cipher) — algebraic explanation and key invertibility check.
Monoalphabetic Substitution Cipher
Encrypt/decrypt with a custom A-Z substitution key and show letter frequencies for didactic analysis.
Frequency Analysis to Break Ciphers
Count letter, bigram and trigram frequencies in ciphertext and compare with Portuguese/English references.
Kasiski Test for Vigenère
Find repeated trigrams in ciphertext, compute GCD of distances and suggest the Vigenère key length.
Index of Coincidence Calculator
Compute Index of Coincidence (IC) of ciphertext to distinguish mono/polyalphabetic ciphers — classic cryptanalysis tool.
Custom Polybius Square
Build a 5×5 Polybius square with a key letter and encrypt/decrypt messages using numeric coordinates.
Pigpen (Masonic) Cipher
Encipher text in Pigpen (the Masonic cipher), drawing all 26 symbols, with the full reference alphabet below.
Tap Code (Prison) Cipher
Convert text to pairs of taps (5×5 prison tap code) and back — visual representation included.
Interactive Alberti Cipher Disk
Alberti cipher disk with two rotating rings — rotate the inner ring and encrypt/decrypt letter by letter.
Diceware Passphrase Generator
Generates a Diceware-style passphrase from a 7776-word list and shows entropy in bits.
Common Password Blacklist Check
Checks a password against the top 1000 most-used passwords, fully client-side, and flags it as compromised.
Password Crack Time Estimator
Estimates brute-force cracking time for a password in three scenarios (online, offline and GPU), from its length and character set. It does not check any leaked-password dictionary.
TOTP otpauth URI Builder
Builds an otpauth://totp/ URI with issuer, account, base32 secret, digits and period for QR code apps.
TOTP vs HOTP Comparison
Compares TOTP and HOTP characteristics in a table and shows how each derives the one-time code.
WebAuthn Options Explainer
Explains each PublicKeyCredentialCreationOptions field (attachment, userVerification, residentKey) for developers.
SAML Response Base64 Decoder
Decodes and indents base64-encoded SAMLResponse XML for inspection — useful for SSO debugging.
OAuth PKCE Pair Generator
Generate an OAuth 2.0 PKCE pair (code_verifier and SHA-256 code_challenge) for secure login flows in mobile apps and SPAs. Protect against code interception.
JWT Claims Explainer
Lists all RFC 7519 registered claims (iss, sub, aud, exp, nbf, iat, jti) with descriptions and basic validation.
API Key Rotation Planner
Computes upcoming API key rotation dates based on an interval (30/60/90 days) and generates an iCal reminder.
.htpasswd Auditor
Paste a .htpasswd file and see each user's hash scheme, the bcrypt cost, malformed lines and duplicate users. It also tests a password against a line.
Email Header Analyzer
Analyzes a raw email header: Received server chain, per-hop delays, SPF, DKIM, DMARC results and spoofing warning signs.
Regex ReDoS Risk Analyzer
Analyzes a regular expression and flags ReDoS-prone parts, such as nested quantifiers and ambiguous alternation, without running it.
Shamir Secret Sharing (Split & Combine)
Splits a secret into shares with Shamir's scheme and rebuilds the original from the minimum number of shares. Runs in your browser.
Source Code Secret Scanner
Finds API keys, tokens, passwords and private keys pasted from code or .env files, by known pattern and by high entropy.
SSH auth.log Analyzer
Analyzes SSH auth.log files: failures per IP, targeted users, accepted logins, attack peaks and ready-to-copy block lists.
Password Policy Batch Auditor
Tests a list of passwords against the policy you define, showing which fail, which rules they break and the equivalent regex.
Typosquatting Domain Generator
Generates look-alike domains by swap, omission, keyboard slip, homoglyph, bitsquatting and other TLDs to monitor typosquatting.