Security tools that keep evidence and secrets on your device

Security work constantly involves material you should not paste into a stranger's website: phishing samples, incident indicators, private keys, 2FA secrets, webhook signing keys. Apart from the SPF/DKIM/DMARC checker, which has to ask DNS about a domain, every tool here does its work with JavaScript and the browser's built-in Web Crypto inside your own tab, and sends nothing anywhere.

The tools cover the everyday jobs of analysts, sysadmins and developers: triaging a suspicious email, pulling indicators out of a report, scoring a vulnerability, checking a domain's email authentication, and producing keys, hashes and codes correctly.

Investigate and triage

Make sense of a suspicious email, a report or a vulnerability.

Email Header AnalyzerTrace Received hops and delays, read SPF/DKIM/DMARC results and flag phishing tricks in pasted headers.Local IOC Extractor & DefangerPull IPs, domains, URLs, emails, hashes, CVEs and ATT&CK IDs out of text; refang, defang and export.Local SPF, DKIM & DMARC CheckerGrade a domain's email authentication: SPF lookups and includes, DMARC policy, DKIM key size and fixes.Uses API CVSS Calculator (v3.1 and v4.0)Score CVSS v3.1 and v4.0 vectors with base, temporal/threat and environmental metrics, severity and a shareable link.Local

Keys, encryption and signatures

Create and check keys, certificates, signatures and encrypted data.

Key Pair & CSR GeneratorMake an RSA, ECDSA or Ed25519 key with its PEM, OpenSSH public key and fingerprint, plus a CSR with SANs, all in your browser.Local SSL Certificate DecoderRead a certificate or chain: subject, issuer, SANs, expiry, key size, extensions and fingerprints, locally.Local AES Text & File EncryptionEncrypt text or files with a passphrase (AES-256-GCM, PBKDF2 600k) and decrypt them again, all in your browser.Local HMAC Generator & Webhook Signature VerifierHMAC-SHA1/256/384/512 in hex or Base64, plus signature checks for GitHub, Stripe, Slack and Shopify webhooks.Local File Hash & Checksum CheckerMD5, SHA-1, SHA-256, and SHA-512 for any file or text, plus a verifier for expected checksums.Local JWT DecoderDecode header, payload and expiry instantly — and verify HS256 signatures with your secret, locally.Local

Passwords and authentication

Generate and verify credentials and one-time codes.

Secure Password GeneratorCryptographically random passwords from the browser's own CSPRNG, with character-set control.Local Bcrypt Hash Generator & VerifierHash a password with bcrypt at the cost you choose, check a password against a $2a$/$2b$/$2y$ hash, and see what each part means.On-device Htpasswd Generator & CheckerBuild .htpasswd files with bcrypt, APR1-MD5 or SHA-1 for Apache and Nginx, and check passwords against existing lines.On-device TOTP / 2FA Code Generator & ValidatorSee and check TOTP/HOTP codes from a Base32 secret or otpauth:// link, measure clock drift, and make a new secret with a QR code.On-device

Good to know

Which tool uses the network?

Only the SPF, DKIM & DMARC checker. It sends the domain name (and DKIM selector) to Google Public DNS over HTTPS, because a browser cannot query DNS directly. Everything else works offline once loaded.

Generated keys and secrets

Keys, TOTP secrets and passphrases exist only in the page's memory and are never stored by the site. Download or copy what you need before closing the tab, and keep private keys somewhere safe.

Other categories

PDF Tools · Developer Tools · Image Tools · Calculators · Network Tools · SEO Tools