🔐 Free Online Security Tools
Free browser-based security tools — file hash verifier, AES file encryption, TOTP code generator, passphrase generator, CSP and security header builders, and secret key generator.
0 tools available · 100% free · No signup required
Security tools are the last category you should paste a secret into on a random website, which is why every tool here does its work with your browser's own cryptography and sends nothing anywhere. You can hash a file and compare it against a published checksum, encrypt a file with a password using authenticated encryption, generate time-based one-time codes to test an authenticator setup, create a diceware passphrase with its real entropy shown in bits, build a Content-Security-Policy directive by directive with an explanation of each, assemble a full set of HTTP security headers in the format your server expects, and generate cryptographically random API keys and signing secrets. There is no upload step in any of them and no key or file ever crosses the network. That is not a marketing line — the page has no server to send anything to, and you can confirm it by disconnecting from the internet after the page loads.
Verify downloads and encrypt files properly
The hash verifier computes SHA-1, SHA-256, SHA-384 and SHA-512 using the browser's native cryptography, plus MD5 and CRC32 for the older checksums still published alongside downloads. Paste the expected hash and it normalises both sides, works out which algorithm the length implies, and gives you an unmistakable match or mismatch — which is how you confirm an installer was not tampered with in transit. File encryption derives a key from your password using six hundred thousand PBKDF2 iterations, the current recommended figure, with a random salt, and encrypts with AES-256 in Galois/Counter Mode so that any tampering with the file is detected rather than silently decrypting to garbage. One warning is repeated prominently because it is absolute: there is no password recovery and no backdoor. If you lose the password, the file is gone permanently, so the tool asks you to type it twice.
One-time codes and passphrases with honest entropy
The one-time code generator implements the standard time-based algorithm and is verified against the published test vectors in the specification, so a code it produces at a given moment matches what any correct implementation produces. It shows the countdown for the current window plus the previous and next codes, which saves you when a code expires halfway through typing it. It is scoped as a testing and debugging aid — for checking that a shared secret is correct or that a server's clock is in step — and it deliberately never saves your secret. The passphrase generator draws words from a wordlist built for this purpose, selects them with cryptographic randomness using rejection sampling so no word is more likely than another, and states the resulting entropy in bits. That number is the honest measure of strength, and seeing that one extra word buys far more than sprinkling in a symbol tends to change how people choose passwords.
Hardening headers, and why randomness matters
The Content-Security-Policy builder walks through each directive, explains what it controls and what breaks when it is wrong, and warns you when an unsafe inline or unsafe eval allowance is enabled, because those largely defeat the protection you are trying to add. The security headers builder covers strict transport security, framing controls, content-type sniffing, referrer policy, permissions policy and the cross-origin isolation headers, and outputs them ready to paste into Nginx, Apache, a Vercel configuration, or a Netlify headers file. Each header is explained alongside the attack it prevents. The secret key generator uses your browser's cryptographic random source rather than the ordinary random function, and the page explains why that distinction is not academic: ordinary pseudorandom output is predictable from previous values, so a key generated that way can be reproduced by someone who works out the seed. Keys are offered in hex, base64, base64url and alphanumeric forms.