Security & Privacy Tools
Generate strong credentials and check the ones you already have, without any of it reaching a server. These tools work with your network connection switched off — which is exactly how security tools should work.
All Security & Privacy Tools (13 Available)
Base64 Encoder
Encode text to Base64, with UTF-8 and URL-safe support.
Base64 Decoder
Decode Base64 back to readable text, standard or URL-safe.
HTML Encoder
Escape HTML special characters to display code safely.
JWT Decoder
Decode a JSON Web Token and inspect its header and claims.
Hash Generator
Generate MD5, SHA-1, SHA-256, SHA-384 and SHA-512 hashes.
SHA-256 Generator
Generate a SHA-256 hash from any text.
SHA-512 Generator
Generate a SHA-512 hash from any text.
MD5 Generator
Generate an MD5 checksum — for integrity, never for security.
What Is My IP Address
See the public IP address your connection presents.
Image Metadata Viewer
Read EXIF data: camera, settings, date and GPS location.
Image Blur Tool
Blur a whole image or just a region to hide sensitive details.
PDF Metadata Viewer
Inspect a PDF’s title, author, dates, producer and permissions.
Unlock PDF
Remove the password from a PDF you already know the password to.
About Security & Privacy Tools
A password generator that sends your password anywhere has defeated its own purpose. Everything in this category is computed with Web Crypto inside your tab: random values, hashes, and strength analysis all happen locally.
The strength checker estimates entropy from the actual character set and length, and separately penalises common patterns — dictionary words, keyboard runs, repeated characters, dates and leetspeak substitutions — because a long password made of predictable parts is not strong.
File hashing uses streaming reads, so you can verify the SHA-256 checksum of a large download without loading the whole file into memory at once.
Security & Privacy Tools FAQs
Is it safe to generate a password on a website?
It is safe when generation is genuinely local, as it is here: the value comes from your browser crypto module and is never sent over the network. You can verify this by loading the page, going offline, and generating — it still works.
Should I type my real password into the strength checker?
The checker never transmits input, but good practice is never to type a live password into any web page. Test a password of the same length and structure instead, or test the new one before you start using it.
What makes a password strong?
Length first, then unpredictability. A 16 character random password from a mixed alphabet is far stronger than an 8 character one with substitutions. Uniqueness matters just as much: a strong password reused across sites is only as safe as the weakest site.
Do you check passwords against breach databases?
No. That would require sending part of your password hash to a third-party service, which conflicts with the offline-first design of these tools. Use the official Have I Been Pwned service directly if you want that check.