Free Security Tools

Verify file hashes, inspect tokens, trace a suspicious email through its headers, and check DNS records, all locally in your browser where the data you paste stays put.

All 15 tools here work now, and none of them needs credits.

Hash GeneratorMD5, SHA-1, SHA-2 and SHA-3 hashes of any text in hex or Base64, plus HMAC signatures.File Checksum CheckerGet MD5, SHA-1, SHA-256 and SHA-512 checksums of any file and verify downloads.Password GeneratorStrong random passwords, one or a list of up to 50, with the characters you choose. Made in your browser.Password Strength CheckerCrack-time estimates for four kinds of attack, what makes a password weak, and a private data-breach check.JWT DecoderDecode a JWT's header and claims, check expiry, and verify the signature with a secret or public key.JWT GeneratorCreate signed JSON Web Tokens for testing: HS256 with a secret, or RS256, ES256 and EdDSA with a key pair.Email Header AnalyzerCheck SPF, DKIM and DMARC, spot spoofing red flags, find the sending IP and trace each hop with its delay.DNS CheckerAll DNS records at once, a comparison of public resolvers after a change, SPF/DMARC checks and reverse lookups.What Is My IPSee your public IP address, country and connection type, plus your browser, OS, screen size and time zone.Base64 Encoder / DecoderEncode text, images or any file to Base64, or decode Base64 back to text or a file, with base64url and data: links.URL Encoder / DecoderPercent-encode or decode text and links, with form encoding (+) and a link's query parameters listed.Regex TesterTest JavaScript regular expressions: matches highlighted, capture and named groups, flags, replace and common patterns.UUID GeneratorUUID v4, v7, v1, v5 and v3 in bulk, GUID formats, and a checker that shows a UUID's version and time.PDF Metadata EditorView, edit or remove a PDF's title, author, subject, keywords and dates, even in protected files.Face BlurFind faces automatically or draw boxes, then blur, pixelate or black them out. AI in your browser, no upload.

Phishing triage

Paste the full headers of a suspicious email into the analyser to see the route it took and its SPF, DKIM and DMARC results. A failed check plus a look-alike domain is a strong warning sign.

Need a tool that isn't here yet? Tell us what you'd use: requests decide what we build next.

Tools for other professions and teams