GALAXY OF TOOLS

SECURITY SECTOR · 24 TOOLS

Free Security & Privacy Tools

Passwords, encryption and checksums, SSL, header and port checks, and SPF, DKIM and DMARC email security. 24 free tools, no sign-up.

Passwords & one-time codes5

Password GeneratorCreate strong random passwords in your browser, with entropy, strength and crack-time estimates.Security & PrivacyPassword Strength CheckerSee how long your password would take to crack, which patterns weaken it and how to fix it — privately.Security & PrivacyPassphrase GeneratorCreate strong, memorable Diceware-style passphrases from the EFF word list, with entropy shown.Security & PrivacyOTP Generator (TOTP & HOTP)Generate and verify TOTP and HOTP one-time codes from a Base32 secret, with a QR code for authenticator apps.Security & PrivacyBcrypt GeneratorGenerate bcrypt password hashes with any cost factor and verify a password against an existing hash.Security & Privacy

Encryption, hashes & validation6

Credit Card ValidatorCheck whether a card number passes the Luhn test and detect Visa, Mastercard, Amex, RuPay and more — offline.Security & PrivacyFile Hash CheckerCompute MD5, SHA-1, SHA-256, SHA-384 and SHA-512 checksums of any file and compare with the expected value.Security & PrivacyIBAN ValidatorValidate any IBAN: country, length, ISO 13616 mod-97 checksum and the bank, branch and account parts.Security & PrivacyText EncryptionEncrypt text or a file with a password using AES-256-GCM and PBKDF2, entirely in your browser.Security & PrivacyPGP Encrypt & DecryptEncrypt, decrypt, sign and verify PGP messages and files, and generate a key pair — all in your browser.Security & PrivacyCRC CalculatorCRC-8, CRC-16, CRC-32 and CRC-64 of text, hex or files with 112 named algorithms or your own parameters.Security & Privacy

Website security checks9

SSL Certificate CheckerDays left on a site’s SSL certificate, plus name match, chain, TLS version and cipher — for up to 10 sites.Security & PrivacyPort CheckerCheck whether a TCP port on a server or home connection is open, closed or filtered — one port at a time.Security & PrivacyCookie DecoderPaste Cookie or Set-Cookie headers to see every value, expiry and flag decoded, explained and checked.Security & PrivacyHTTP Header CheckerSee every response header of a URL at each redirect hop, grouped and explained — and compare two URLs.Security & PrivacySecurity Header CheckerGrade a site’s security headers A+ to F with a transparent score, plus copy-paste fixes for your server.Security & PrivacySSL Certificate DecoderDecode certificates, chains and CSRs locally: names, SANs, expiry, keys, extensions, SCTs and fingerprints.Security & PrivacyCSP GeneratorBuild a Content-Security-Policy directive by directive, add nonces or hashes, and check an existing policy.Security & PrivacyCookie GeneratorBuild a valid Set-Cookie header with Express, PHP, Python, Nginx and JavaScript code, then test it here.Security & PrivacyCORS TesterTest whether an API allows a cross-origin call: preflight, Access-Control headers and a verdict with reasons.Security & Privacy

Email security4

Email ValidatorValidate email addresses against RFC rules, catch typos like gmial.com and spot disposable or role addresses.Security & PrivacyDMARC Record CheckerFind the DMARC policy that applies to a domain, check report addresses and alignment, and generate a record.Security & PrivacySPF Record CheckerExpand a domain’s SPF includes, count DNS and void lookups, test a sending IP and build a new record.Security & PrivacyDKIM Record CheckerLook up a DKIM selector, decode its public key, flag weak, revoked or testing keys and scan common selectors.Security & Privacy

Passwords, encryption and checks that stay on your device

Most account break-ins start with a weak or reused password, and most tampered downloads go unnoticed because nobody checked the file. These free security and privacy tools make the safe habit the easy one. The password generator creates long random passwords with the character rules a site demands, the passphrase generator builds memorable word-based phrases, and the password strength checker estimates how long a password would take to crack and explains what makes it weak.

Beyond passwords, text encryption locks a message with a password so only someone who knows it can read it, the file hash checker verifies that a downloaded installer matches the checksum its publisher lists, and the bcrypt generator hashes and verifies passwords for developers building login systems. Validators for card numbers, email addresses and IBANs catch typos in forms and test data before they cause failed payments.

Because the data involved is exactly the kind you should never send to a stranger’s server, every tool here works entirely in your browser. Passwords are generated with the browser’s cryptographic random number source, hashes are computed locally, and nothing you type or upload leaves your device. Home users, IT support staff, developers, small businesses setting up shared accounts and anyone who has just received a “your password was found in a breach” email will find these useful.

Password or passphrase, encryption or hashing?

  • Random password such as q7#Vt9!mZpL2 is strongest per character and ideal when a password manager remembers it for you. Use 16 characters or more wherever the site allows.
  • Passphrase such as copper-violin-meadow-lantern is easier to type and remember, so it suits the few passwords you must know by heart: your computer login, your password manager and your main email.
  • Encryption is reversible with the right key. Use it to protect a note, a password you must share or a message you want to keep private in transit.
  • Hashing is one-way. A hash proves a file or password matches a known value without revealing it, which is why websites store password hashes rather than passwords. Bcrypt is deliberately slow to resist guessing attacks; fast hashes such as SHA-256 suit file integrity instead.

Habits that protect your accounts

  • Use a different password for every account. A breach at one site should not open the door to your email or bank.
  • Turn on two-factor authentication wherever it is offered, ideally with an authenticator app or a hardware key rather than SMS.
  • Check the hash of software downloaded from mirrors or torrents against the one on the publisher’s official page before installing.
  • Treat a long passphrase as better than a short complex password. Length adds more strength than symbols do.
  • A valid-looking card or IBAN only passes a checksum; it does not prove the account exists or has funds. Validators are for catching typos, not for verifying customers.
  • For hashing text, Base64 and other developer encodings, see the developer tools.

Security & Privacy: frequently asked questions

How long should a password be?

At least 12 characters, and 16 or more where allowed. A long random password or a four-to-five-word passphrase is far stronger than a short one padded with a symbol and a number.

Are the generated passwords stored anywhere?

No. Passwords are created in your browser using its cryptographic random number generator and are never sent to a server, logged or saved. Once you close the page, the only copy is the one you kept.

How do I check that a downloaded file has not been tampered with?

Open the file in the file hash checker, pick the algorithm the publisher used (usually SHA-256) and compare the result with the checksum on their download page. If the two do not match, do not install the file.

What is the difference between hashing and encryption?

Encryption scrambles data so that it can be unscrambled with a key. Hashing produces a fixed-size fingerprint that cannot be reversed, which makes it suitable for verifying files and storing passwords.

Why is bcrypt used for passwords instead of SHA-256?

Bcrypt is intentionally slow and has an adjustable cost factor, so an attacker trying billions of guesses is slowed down dramatically. SHA-256 is designed to be fast, which is good for file checksums and bad for password storage.

How does the credit card validator work without contacting the bank?

It applies the Luhn checksum that every valid card number satisfies and recognises the number ranges used by Visa, Mastercard, RuPay, Amex and others. It can tell you a number is mistyped, but not whether the card is real or active.