Security & Privacy

4 free online tools — Passwords, hashes and encryption — all client-side

Security tools built on the browser's own cryptography (Web Crypto), so a password, a secret or a file is generated, checked, encrypted or hashed on your device and never transmitted. Generate strong passwords and see honestly how strong an existing one is; encrypt text with AES-256-GCM; compute hashes; produce authenticator (TOTP) codes from a secret.

TOTP Generator (2FA) Generate a 2FA secret and QR code, read a QR code back to its secret, get live codes from any secret, and verify codes — all in your browser. AES Encrypt / Decrypt Encrypt and decrypt with AES-128 or AES-256 using your own key and IV — or just a password. Password Strength Checker An honest strength estimate with crack times — and nothing you type leaves your browser. Password Generator Create cryptographically random passwords that are genuinely hard to crack.

What is here

  • Password generator — cryptographically random, with length and character options, and a passphrase mode.
  • Password strength checker — entropy with pattern penalties for dictionary words, leet substitutions, keyboard runs and dates, so "P@ssw0rd2024" is rated for what it is.
  • AES encryption — standard AES-128/256 in CBC, ECB, CTR or GCM with your own key and IV, matching OpenSSL; or one-step password encryption with AES-256-GCM and PBKDF2.
  • Hash generator — MD5, SHA-1, SHA-256 and SHA-512 for text and files, with a note on which are still safe for what.
  • TOTP generator — generate 2FA secrets and QR codes, read a QR code or Google Authenticator export back to its secret, and verify codes against a drift window.

Why these must run locally

A password strength checker that sends passwords to a server is a phishing kit with a friendly face. Every tool on this page runs in the browser, and the promise is verifiable: open the network panel while using them and nothing leaves. The site has no account system and stores nothing, which is also why there is no "recover my encrypted text" — the key is derived from your password and exists nowhere else.

Honest limits

Encryption here protects a message against anyone who does not have the password; it does not protect against malware on your own machine, and it is only as strong as the password. The hash tools compute hashes; they do not "decrypt" them, because hashes are not encryption — a page that claims to reverse SHA-256 is looking the value up in a table of known inputs.