Category
Security Tools & Calculators
Security utilities powered by the W3C Web Cryptography API (SubtleCrypto). No secrets, passwords, or hashes are ever transmitted over the network.
Every tool in this category runs on the browser’s Web Cryptography API (SubtleCrypto) or plain client-side JavaScript. Passwords, secrets, and hashes never leave your device — you can verify this in your browser’s network tab, which stays empty during use.
Most used in Security
Secure Password Generator
Generate cryptographically secure passwords locally via crypto.getRandomValues() with accurate real-time entropy scoring and zero server transmissions.
UUID Generator (v4 & v7)
Generate random UUID v4 and time-ordered UUID v7 identifiers locally using native browser crypto primitives with bulk and case options.
All Security
Cryptographic Hash Generator
Compute secure cryptographic message digests client-side using native window.crypto.subtle and pure JS MD5 with legacy safety indicators.
Base64 Encoder & Decoder
Encode or decode text to Base64 ASCII strings with full multi-byte Unicode UTF-8 handling.
URL Encoder & Decoder
Convert special characters to percent-encoded hex sequences (%20) and decode URI strings.
Random String Generator
Generate cryptographically secure random strings for tokens, IDs, and keys — with full control over length and character sets.
Text Entropy Analyzer
Measure the Shannon entropy of any text or password — bits per character, total bits, and a plain-language strength assessment.
What strength really means
Password strength is measured in entropy: log2(charsetSize ^ length). A 16-character random password over 94 printable symbols carries about 104 bits of entropy — infeasible to brute force. Length dominates: a 20-character lowercase-only password (94 bits) beats a 12-character all-charset one (70 bits). The generator reports entropy so you can compare options with numbers instead of vibes.
Hashing is one-way, encoding is not
- Hash functions (SHA-256, SHA-512) are one-way: identical input always yields the same digest, but the digest cannot be reversed. Use them to verify file integrity or store password verifications (properly salted).
- Base64 and URL encoding are reversible transformations, not security. Encoding a password in Base64 provides zero protection.
- JWT decoding shows a token’s claims without verifying anything — signature verification must happen with the secret on your server.
Common mistakes
- Trusting client-side generation for high-stakes secrets on a compromised device — a keylogger defeats any generator.
- Reusing one strong password everywhere instead of using a manager with unique per-site passwords.
- Comparing hashes case-insensitively or with whitespace — copy-paste artifacts are the most common cause of "mismatch" results.