Free Security & Privacy Tools
Everything you need to lock down accounts, apps and websites — generate strong passwords and tokens, hash and verify data, sign and inspect JWTs, check SSL certificates, security headers, CORS and CSP, audit your domain's email security, test suspicious links, and see what your browser and files reveal about you. Free, no sign-up, and client-side wherever possible.
Strong Password Generator
Generate strong, random passwords with the exact length and characters you need.
Password Strength Checker
Test how strong your password really is, how long it takes to crack, and whether it's been breached.
Passphrase Generator
Create strong, memorable passphrases from random words (EFF diceware list).
PIN Generator
Generate random 4, 6 or 8-digit PIN codes — without sequences, repeats or common PINs.
Random String Generator
Generate random strings of any length from letters, numbers, hex, symbols or your own characters.
Username Generator
Generate unique username ideas from your name or keywords — fun, cute, gaming or professional.
Password Entropy Calculator
Calculate password entropy in bits — the naive formula and a realistic, pattern-aware estimate.
SHA-256 Hash Generator
Generate SHA-256 hashes of text or files instantly — hex or Base64, with checksum comparison.
MD5 Hash Generator
Generate MD5 hashes of text or files instantly — hex or Base64, with checksum comparison.
SHA-1 Hash Generator
Generate SHA-1 hashes of text or files instantly — hex or Base64, with checksum comparison.
SHA-512 Hash Generator
Generate SHA-512 hashes of text or files instantly — hex or Base64, with checksum comparison.
SHA-3 Hash Generator
Generate SHA-3 hashes of text or files instantly — hex or Base64, with checksum comparison.
HMAC Generator
Generate and verify HMAC signatures with SHA-256, SHA-512, SHA-1, MD5 or SHA-3.
Bcrypt Generator
Generate bcrypt password hashes with any cost factor, and verify a password against a hash.
File Hash Checker
Verify a downloaded file's checksum (SHA-256, SHA-512, SHA-1, MD5) — or compare two files.
Checksum Calculator
Calculate CRC-32, Adler-32, 8-bit sum/XOR, MD5, SHA-1 and SHA-256 checksums of text, hex or files.
JWT Generator
Create and sign JSON Web Tokens with HS256, RS256, ES256 and more — in your browser.
JWT Signature Verifier
Verify a JWT's signature with a secret, public key, JWK or JWKS — and check its claims.
JWT Expiration Checker
See when a JWT expires, how long it has left, and convert exp/iat timestamps to dates.
UUID Generator
Generate UUID v4 and v7, ULID, CUID2 and NanoID in bulk — and decode any UUID.
Secure Token Generator
Generate cryptographically secure random tokens and secrets in hex, Base64url, Base62 or Base32.
API Key Generator
Generate secure API keys with a prefix and optional checksum, like sk_live_… keys.
CSRF Token Generator
Generate secure CSRF tokens and copy correct server-side code for Node, Python, PHP, Go and Java.
Webhook Signature Generator
Generate and verify webhook signatures for GitHub, Stripe, Slack, Shopify, Standard Webhooks and Twilio.
SSL Checker
Check a site's SSL/TLS certificate, chain, expiry, TLS versions, HTTPS redirect and HSTS.
Security Headers Checker
Scan any website's HTTP security headers and get an A+ to F grade with fixes.
HTTP Header Checker
View every HTTP response header a URL returns, with explanations and the redirect chain.
HTTP Status Checker
Bulk-check HTTP status codes and redirect chains for up to 100 URLs.
CORS Checker
Test an endpoint's CORS policy with any Origin and a real preflight — find dangerous misconfigurations.
CSP Header Generator
Build a Content-Security-Policy — strict nonce-based or allowlist — for any server or framework.
CSP Evaluator
Analyse a Content-Security-Policy for bypasses and weaknesses — paste it or fetch it from a URL.
Cookie Security Checker
Check a site's cookies for Secure, HttpOnly, SameSite, prefix and scope issues.
Certificate Expiry Checker
Check SSL certificate expiry dates for up to 20 domains at once.
Mixed Content Checker
Find insecure http:// scripts, stylesheets, images and iframes on an HTTPS page.
Domain Security Checker
Scan a domain's email, DNS and HTTPS security: SPF, DMARC, DNSSEC, CAA, SSL, HSTS and headers.
SPF Record Checker
Validate a domain's SPF record, count DNS lookups against the limit of 10, and see the include tree.
DKIM Record Checker
Look up and validate DKIM public keys — with automatic search of 45 common selectors.
DMARC Record Checker
Check a domain's DMARC policy, reporting and alignment — and get a starter record if it's missing.
DNSSEC Checker
Check whether a domain has DNSSEC enabled and validating — DNSKEY, DS records and chain of trust.
Subdomain Finder
Find a domain's subdomains from public Certificate Transparency logs — no scanning required.
URL Safety Checker
Check if a link is safe: see where it really goes, domain age, and phishing and malware warning signs.
Phishing Link Checker
Analyse a suspicious link for phishing tricks: look-alike domains, hidden destinations and new domains.
What Is My IP Address
See your public IP address, IPv4/IPv6, country and privacy signals — plus a WebRTC leak test.
Browser Fingerprint Test
See how unique your browser is and what it reveals: canvas, WebGL, fonts, screen and more.
Image Metadata Viewer
View EXIF, GPS location, camera and XMP metadata hidden in photos — privately in your browser.
PDF Metadata Viewer
View a PDF's hidden metadata — author, software, dates, XMP and custom fields — without uploading it.
PDF Metadata Remover
Remove author, software, dates, XMP metadata and document IDs from a PDF — in your browser.
Privacy Policy Generator
Generate a clear privacy policy for your website or app covering GDPR and CCPA — free template.
Cookie Policy Generator
Generate a cookie policy with a table of the cookies your services set — Google Analytics, AdSense and more.
GDPR Checklist
An interactive data privacy compliance checklist for GDPR, UK GDPR and CCPA — track your progress.