Security & Privacy

4 free online tools — Passwords, hashes and encryption — all client-side

Security tools built on the browser's own cryptography (Web Crypto), so a password, a secret or a file is generated, checked, encrypted or hashed on your device and never transmitted. Generate strong passwords and see honestly how strong an existing one is; encrypt text with AES-256-GCM; compute hashes; produce authenticator (TOTP) codes from a secret.

TOTP Generator (2FA) Generate authenticator secrets and QR codes, and watch the live 6-digit codes — RFC 6238, in your browser. AES Encrypt / Decrypt Real AES-256-GCM in your browser: encrypt a message, share it, decrypt with the password. Password Strength Checker An honest strength estimate with crack times — and nothing you type leaves your browser. Password Generator Create cryptographically random passwords that are genuinely hard to crack.

What is here

  • Password generator — cryptographically random, with length and character options, and a passphrase mode.
  • Password strength checker — entropy with pattern penalties for dictionary words, leet substitutions, keyboard runs and dates, so "P@ssw0rd2024" is rated for what it is.
  • AES encryption — real AES-256-GCM with PBKDF2 key derivation, a fresh salt and IV per message, and clean failure on a wrong password.
  • Hash generator — MD5, SHA-1, SHA-256 and SHA-512 for text and files, with a note on which are still safe for what.
  • TOTP generator — the six-digit authenticator code from a secret, for testing two-factor setups.

Why these must run locally

A password strength checker that sends passwords to a server is a phishing kit with a friendly face. Every tool on this page runs in the browser, and the promise is verifiable: open the network panel while using them and nothing leaves. The site has no account system and stores nothing, which is also why there is no "recover my encrypted text" — the key is derived from your password and exists nowhere else.

Honest limits

Encryption here protects a message against anyone who does not have the password; it does not protect against malware on your own machine, and it is only as strong as the password. The hash tools compute hashes; they do not "decrypt" them, because hashes are not encryption — a page that claims to reverse SHA-256 is looking the value up in a table of known inputs.