🚨 Password Breach Check external
Checks a password against billions of leaked credentials using k-anonymity: your password is hashed locally and only the first 5 characters of that hash ever leave this page. The response is padded with decoys, so the service cannot tell which password you checked — or even that you found a match.
📚 Breach Directory external
The full public catalogue of known breaches — search by company or domain to see when it happened, how many accounts were affected and exactly which types of data were exposed. Loading the catalogue sends no information about you; it is the same public list for everyone.
🛡️ Password Auditor
Estimates how long a password survives an offline attack, and calls out the patterns that make it guessable. Runs entirely locally — nothing is sent anywhere.
🎲 Passphrase Maker
Random words are far easier to remember than random characters and, at enough words, much harder to crack. Words are chosen with the browser's cryptographic RNG from a —-word list.
💥 Weak Hash Tester
Demonstrates why an unsalted hash of a weak password is not protection: this hashes a built-in list of the most common passwords and compares. If your hash matches, so would the first second of any real attack. It only ever tests that fixed list — it cannot break a strong password.
🔒 Encrypt a Message
AES-256-GCM with a key stretched from your password by PBKDF2 (250,000 iterations, SHA-256). A fresh random salt and nonce are generated per message, so encrypting the same text twice gives different output — that is expected.
📱 2FA Code Generator
Generates the same six-digit codes as an authenticator app, from the secret shown during 2FA setup. Useful for testing a login flow or recovering access when your phone is not to hand. The secret stays in this tab and is never stored or sent.
🎰 Token Generator
Cryptographically random values for API keys, session secrets, JWT signing keys and nonces.
✒️ HMAC Signer
Generate an HMAC the way webhook providers sign their payloads, then paste in the signature you received to compare.
🔤 Cipher Playground
Classic ciphers for puzzles and CTFs. These are not encryption — anything here is trivially reversible. Use the AES tool for real secrets.
🎣 Phishing URL Inspector
Paste a suspicious link to break it apart safely — nothing is opened or fetched. Checks for homograph domains, credential tricks, brand impersonation, open redirects and obfuscation.
📧 Email Header Analyzer
Paste the raw headers of a suspicious email (in Gmail: ⋮ → Show original). Checks SPF, DKIM and DMARC results, mismatched sender domains and the delivery chain. Entirely local.
📋 Security Headers Analyzer
Paste a site's HTTP response headers (from your browser's Network tab) for a graded report. A browser cannot read another origin's headers, so this takes a paste rather than fetching them.
🔎 Domain Security Check external
Looks up a domain's email-authentication and certificate policy over DNS-over-HTTPS: SPF, DMARC, common DKIM selectors, CAA and DNSSEC. The domain you enter is sent to Cloudflare's resolver.
🎫 JWT Decoder
Decodes the header and payload and flags expiry. Decoding proves nothing about authenticity — supply the secret below to actually verify an HS256/384/512 signature.
🕵️ Hash Identifier
Works out what a mystery digest probably is from its shape and prefix. Identification only — this does not reverse or crack anything.
📦 File Integrity Checker
Verify that a download matches the checksum its publisher listed. The file is read in your browser and never uploaded — this works fine for large files.
Drop a file here
or click to browse