Security and privacy tools

Generate a strong password or passphrase, check whether one has leaked without sending it, hash and sign, read a JWT or an SSL certificate, encrypt a file, strip the metadata a photo carries, and black out what should not be in a document. Everything runs in your browser.

Password Generator — Create strong random passwords and memorable passphrases entirely in your browser — adjustable length, character sets and a live strength estimate. Nothing is ever sent anywhere.
Password Strength — Check a password honestly. Raw entropy flatters something like Password123!, so this penalises what actually makes a password guessable: common words, keyboard walks, runs, repeats, years and predictable shapes. Nothing you type leaves the page.
Passphrase Generator — Build a passphrase from a 1296-word list — 10.3 bits a word, short enough to type. You can also roll physical dice and enter the numbers, the original diceware method and the only version whose randomness you need not take on trust. There is an Arabic wordlist too.
2FA Code Generator — Turn a two-factor secret into the rolling six-digit code, exactly as an authenticator app would (RFC 6238 TOTP, SHA-1/256/512, 6 or 8 digits). Paste the base32 secret or the whole otpauth:// link. The secret never leaves the page.
File Encryptor — Encrypt any file with a password using AES-256-GCM (with a PBKDF2-derived key), then decrypt it later with the same password. The file and password never leave your browser — real, standard cryptography on your device.
Hash Generator — Compute SHA-1/256/384/512 of any text or file — hex and Base64. Files are hashed locally and never uploaded.
HMAC Generator — Compute an HMAC over any message with a shared secret — SHA-256, SHA-1, SHA-384 or SHA-512, key as text, hex or base64, output as hex or base64. Paste the value you were sent and it tells you whether it matches, which is what you need when debugging a webhook signature.
JWT Decoder — Paste a JSON Web Token to decode its header and payload into readable JSON, with expiry and issued-at times shown in local time. Decoding happens entirely in your browser — the token is never uploaded and the signature is not verified.
Certificate Decoder — Paste a PEM certificate and read what is actually in it: who it was issued to and by, when it expires and in how many days, the key and signature algorithms, every hostname it covers, its extensions and its SHA-256 fingerprint. Decoded in your browser by a small ASN.1 parser — nothing is uploaded, and no online checker sees your certificate.
Email Header Analyser — Paste the raw headers of an email and see the route it actually took, with the delay at each hop, plus the SPF, DKIM and DMARC verdicts explained in plain words and a note of anything worth a second look — a reply address on another domain, an authentication failure. Parsed in your browser, never uploaded.
Data Anonymizer — Before you send a spreadsheet to a colleague, a vendor or a chatbot, remove the parts that identify a person — emails, phone numbers, IBANs, Saudi ID and iqama numbers, card numbers, IPs. Mask, redact, or replace each value with a stable label. Runs entirely in this page.
Remove Image Metadata — Strip EXIF, GPS, XMP and IPTC data from a photo before you share it — without re-compressing the image, so quality is untouched. Never uploaded.
Image Redactor — Drop an image and drag boxes over anything sensitive — faces, names, numbers — to pixelate or black it out, then download the redacted picture. The redaction is baked into the pixels and everything runs on your device.
Redact a PDF — Drag over anything that has to go. A black rectangle drawn in a PDF viewer hides nothing — the text stays in the file and can be selected, copied or extracted with one command. This rebuilds each page as an image so the words genuinely cease to exist, then re-reads the export to prove none are left.
Hide Text in Image — Hide a text message inside an image by tweaking the least-significant bits of its pixels — the picture looks unchanged — then reveal it later from the saved PNG. Everything happens on your device; nothing is uploaded.

Security and privacy tools

Other categories