Security & privacy

Generate strong random passwords from 8 to 128 characters, with the entropy shown.

Check how strong a password is: entropy, weak patterns, estimated time to crack and advice.

Create a modern password policy: length, blocklists, passphrases, expiration and attempt limits.

Decode a JWT to read its header, payload, claims and expiration dates.

Create the Authorization: Basic header from a username and password, or decode an existing header.

Create and sign an HS256, HS384 or HS512 JWT from a header, a JSON payload and a secret.

Verify a JWT signature with an HMAC secret or a JWK, JWKS or PEM public key, then check exp, nbf, iss and aud.

Generate secure random tokens from 8 to 256 bytes in hex, Base64 or Base64URL, with an optional prefix.

Generate a PKCE code_verifier, its S256 code_challenge and a state for your OAuth authorization request.

Generate TOTP 2FA codes from a Base32 secret, build the otpauth:// URI and verify a 6- or 8-digit code.

Inspect a JWK or JWKS: kid, kty, alg, use, RFC 7638 thumbprint and a warning when private key material is exposed.

Compute MD5, SHA-1, SHA-256, SHA-384 and SHA-512 hashes of a text or file in one go.

Compute an HMAC-SHA-1, SHA-256, SHA-384 or SHA-512 in hex or Base64 and verify a webhook signature.

Derive a salted PBKDF2-SHA-256 or SHA-512 password hash, or verify a password against an encoded value.

Generate the SRI integrity attribute of a script or stylesheet from pasted content, a file or a CDN URL.

Check whether two hashes or checksums match, regardless of case, spaces or colons.

Encrypt and decrypt text with a password using AES-256-GCM, right in your browser.

Decode a PEM X.509 certificate or CSR: subject, issuer, dates, SANs, public key and SHA-256 fingerprint.

Build a Content Security Policy directive by directive, with HTTP header, meta tag and warnings.

Generate HSTS, nosniff, Referrer-Policy, Permissions-Policy, COOP/COEP/CORP and X-Frame-Options for Nginx or Apache.