Security tools
15 tools that run in your browser. Nothing to install, nothing uploaded.
Password, hashing and encoding tools that never send anything to a server. This matters more here than anywhere else on the site: a page that handles passwords or secrets while loading third-party ad scripts is a genuine vulnerability, not a theoretical one, because those scripts run in the same page as your plaintext. Every tool in this section carries no advertising and ships a Content-Security-Policy that blocks outbound connections — so the claim that nothing leaves your browser is one you can verify in the page source.
- Base64 Encoder / DecoderEncode text to Base64 or decode it back — UTF-8 safe, in your browser.
- Bulk Password GeneratorGenerate a list of random passwords at once, for provisioning rather than for one account.
- File Checksum VerifierVerify a download's checksum without uploading the file anywhere.
- Hash GeneratorGenerate SHA-1, SHA-256, SHA-384 or SHA-512 hashes of text, in your browser.
- HMAC GeneratorCompute an HMAC, and see why it is not a hash of the key and the message.
- Memorable Password GeneratorPronounceable passwords, with the entropy that pronounceability actually costs.
- Passphrase Generator (Diceware)Memorable passphrases from a published word list, with the entropy stated.
- Crack-Time EstimatorSee how long a password would survive a real attack — and why patterns cut it short.
- Password Entropy CalculatorMeasure a password’s entropy in bits — the honest way.
- Password GeneratorGenerate a genuinely random password, entirely in your browser.
- Password Strength CheckerSee how long a password would actually survive — and why length beats symbols.
- PIN GeneratorGenerate a random PIN, digits only.
- Random String / Key GeneratorGenerate a random alphanumeric string.
- Secure Note Encrypt / DecryptEncrypt a note with a passphrase, entirely in your browser.
- 2FA / TOTP QR Generator & ValidatorGenerate a TOTP secret and QR code, and verify codes — without the secret leaving your browser.
Why these pages carry no advertising
A page that generates a password while loading third-party ad scripts has a genuine vulnerability, not a theoretical one. Ad tags are arbitrary JavaScript from a network of intermediaries, running in the same document, with the same access to the DOM as the tool itself — so the plaintext you generated is one compromised tag away from leaving. Every tool in this category is therefore served ad-free and ships a Content-Security-Policy that blocks outbound connections entirely. That is a claim you can check rather than take on faith: open the page source, read the policy meta tag, and watch the network panel stay empty while you use the tool.
Length beats complexity, and it is not close
The advice to mix uppercase, digits and symbols comes from a 1980s guideline that its own author has since disowned, and it survives mostly in password fields that reject a good passphrase for having no punctuation. The arithmetic is unsentimental: each additional character multiplies the search space by the size of the alphabet, so adding length gains far more than adding one symbol class to a short password. Worse, complexity rules push people toward predictable substitutions — a capital at the front, a digit and an exclamation mark at the end — which every real cracking wordlist tries first. A long random passphrase from a published word list is both stronger and possible to remember.
What a strength estimate is actually telling you
Entropy in bits measures the size of the space a password was drawn from, which is only meaningful if it really was drawn randomly. That is why the honest version of this calculation cares how a password was produced, not how it looks: a genuinely random twelve-character string and a memorable sentence padded to twelve characters score very differently against an attacker using a wordlist. Crack-time figures come with an assumption attached — a rate of guesses per second, against a particular hashing scheme — and changing that assumption moves the answer by orders of magnitude, so treat the number as a comparison between passwords rather than as a prediction.
Hashing and encoding are not encryption
Two confusions cause real damage here. Base64 is an encoding, designed to move binary data through text-only channels; anyone can reverse it instantly, and putting a secret in Base64 protects nothing at all. A hash is one-way, but a plain SHA-256 of a password is still weak against an attacker with a wordlist, because they can hash candidates as fast as you can — password storage needs a slow, salted function such as bcrypt, scrypt or Argon2 rather than a general-purpose digest. The hash tools here are for verifying file integrity and comparing values, which is what fast digests are genuinely good for.
Frequently asked questions
Is a password generated in a browser actually random?
Yes, when it comes from the Web Crypto API, which is what these use. That is the browser’s cryptographically secure random source, seeded from the operating system entropy pool, and it is the same class of generator a password manager relies on. What would not be acceptable is Math.random, which is fast, predictable and entirely unsuitable for secrets — and which a surprising number of generator pages still use.
How do I know the password never leaves my browser?
Check it rather than trust it. These pages ship a Content-Security-Policy that blocks outbound connections, which is visible in the page source, and they carry no advertising or analytics. With your developer tools open on the network tab, generate a password and watch: nothing is requested. You can also disconnect from the network entirely and the tool will keep working, because there is no server involved.
Should I use a long passphrase or a short complex password?
The long passphrase, in almost every case. Length multiplies the search space far faster than adding a symbol class to a short password, and the substitutions people make to satisfy complexity rules are the first things a cracking wordlist tries. Four or five random words from a published list is both stronger than a typical eight-character scramble and possible to type from memory.
Is Base64 a way of protecting data?
No. Base64 is an encoding for moving binary data through text-only channels, and reversing it takes one command and no key. A token or password in Base64 is in plaintext for any practical purpose. If you need confidentiality you need encryption with a key you keep, and if you need to store passwords you need a slow salted hash such as bcrypt, scrypt or Argon2 — not an encoding and not a fast digest.