Every tool on this page runs as client-side JavaScript in your browser. Your input is processed on your own machine and is never transmitted to this server or stored. Where a tool has to contact an outside service to work at all, that requirement is stated on the tool page itself rather than buried in a policy.
| Behavior | What It Means |
|---|
| Runs locally | Arithmetic, parsing, encoding, hashing, and decoding all happen in your browser |
| No upload | Your input is not sent to this server, and no server-side copy exists |
| No storage | No cookies, no local storage, and no logging of what you typed |
| Exceptions stated | A tool that calls an external API says so on its own page |
Two tools are exceptions, and both disclose it directly:
- What’s My IP queries ipify.org to learn your public address. Your browser has to ask someone, so that request leaves your machine.
- Security Headers Check requests a URL you provide. Because the request comes from your browser, a site with hardened CORS policies can refuse it.
Everything else is local. If a tool ever needs to send data somewhere, that will be stated on the tool page before you use it.
| Link | Tool Description |
|---|
| Password Strength Checker | Check the strength of your passwords with our Password Strength Checker tool. Ensure your passwords are secure and protect your online accounts. |
| Password Generator | Generate strong random passwords in your browser using the Web Crypto API. Uses rejection sampling to avoid modulo bias, and nothing is transmitted or stored. |
| Link | Tool Description |
|---|
| String Hash Calculator | Enhance cybersecurity with our Hash Calculator tool, calculating MD5, SHA-1, and SHA-256 hash values to verify file integrity. |
| Base64 Encoder and Decoder | An online tool to encode or decode text or files using Base64 encoding. Convert data for data transmission and storage. |
| URL Encoder and Decoder | Percent-encode or decode text, query values, and full URLs. Separate component and full-URL modes with clear errors for malformed input. |
| HMAC Calculator | Compute an HMAC signature with SHA-256, SHA-1, SHA-384, or SHA-512 to verify webhook signatures and API request signing. Your shared secret stays in the browser. |
| Base32 Encoder and Decoder | Encode text to RFC 4648 Base32 or decode it back. The usual first step when checking why a TOTP secret will not produce valid codes. |
| HTML Entity Encoder and Decoder | Encode the characters that change meaning inside HTML, or decode named and numeric entities back to text. Useful for reviewing encoded payloads. |
| Escape Sequence Decoder | Decode backslash escapes in hexadecimal, Unicode and octal forms such as \x3c, \u0041 and \101, then re-escape non-printables for safe pasting. |
| Link | Tool Description |
|---|
| Magnetic Stripe Decoder and Encoder | Decode Track 1 and Track 2 from a payment card or ID, read the PAN, cardholder name, expiry, service code and discretionary data, then edit any field and get correctly re-encoded tracks with sentinels and a calculated LRC. Everything runs locally, so card data never leaves the browser. |
| Link | Tool Description |
|---|
| JWT Decoder | Decode the header, payload, and registered claims of a JSON Web Token without sending it anywhere. Flags unsecured tokens and expired claims, and states plainly that decoding is not verification. |
| Unix Timestamp Converter | Convert Unix timestamps in seconds or milliseconds to ISO 8601, UTC, and local time, or turn a date string back into an epoch value. Detects which unit you supplied instead of guessing. |
| UUID Generator | Generate cryptographically random version 4 UUIDs in bulk using the Web Crypto API, with the version and variant bits set correctly rather than pasted in by hand. |
| Cron Expression Parser | Parse a five field cron expression, see what each field matches in plain language, and list the next ten run times. Handles ranges, lists, steps, and named months and days. |
| Link | Tool Description |
|---|
| Hash Identifier | Identify a hash format from its length, character set, and prefix. Recognises bcrypt, Argon2, crypt formats, LDAP schemes, and the common hex lengths, and states plainly that length narrows the field without deciding it. |
| CVSS v3.1 Calculator | Calculate a CVSS v3.1 base score from the eight base metrics. Shows the exploitability and impact sub-scores, generates the vector string, and colour-codes the severity band. |
| IOC Defang, Refang, and Extractor | Defang indicators so they are inert, refang them for your own tooling, and pull URLs, IP addresses, hashes, emails and domains out of raw text. Live incident data never leaves the browser. |
| Entropy Analyzer | Measure Shannon entropy to tell repetitive data from encoded, compressed or encrypted content. Indispensable for a first look at a suspected payload, and it runs locally so samples stay put. |
| Hex Dump Viewer | Render text or a hex string as a classic hex dump with offsets, byte columns and an ASCII gutter. Handy for spotting magic numbers and unexpected bytes without uploading a sample. |
| Classic Ciphers | Apply ROT13, Atbash, a full Caesar brute force across all 26 shifts, or XOR with a text or hex key. Built for CTF work and for showing why substitution ciphers are not encryption. |
| TOTP and HOTP Generator | Generate one time codes from a Base32 secret or an otpauth URI, with a live countdown and a verifier that checks the current, previous and next window. The secret never leaves the browser. |
| SSH Public Key Fingerprint | Compute the SHA-256 fingerprint of an SSH public key, matching ssh-keygen -lf exactly, and report the key type and size parsed straight from the key blob. |
| Link | Tool Description |
|---|
| Image Exif Viewer | An online tool to view EXIF information of an image. Extract metadata such as camera model, exposure settings, and GPS coordinates. |
| Link | Tool Description |
|---|
| Shodan IP Lookup | An online tool to perform a Shodan IP lookup. Retrieve information such as hostnames, open ports, tags, CPEs, and vulnerabilities associated with an IP address. |
| Nmap Command Generator | A menu-based tool that generates Nmap commands based on user input for scanning IP addresses, domains, or IP ranges. |
| HTTP Ping Tool | A client-side tool that allows you to ping a domain or IP address and view the latency results. |
| What’s My IP | Check your public IP address with our What’s My IP tool. Easily find your IP address for networking and security purposes. |
| Security Headers Check | Check the security headers of a website and ensure it follows best security practices. This tool is capable of handling some CORS policies. |
| CIDR Subnet Calculator | Work out the network address, broadcast address, subnet mask, wildcard mask, and usable host range for any IPv4 CIDR block, with a binary breakdown and private range detection. |
| IP Address Format Converter | Convert an address into decimal, hex, octal, binary, short and IPv4-mapped IPv6 forms so you can check whether your own validation normalises a value before blocking it. |
| URL Parser and Query Analyzer | Break a URL into scheme, credentials, host, port, path, query and fragment, decode the path, and list every parameter. Flags credentials in the URL and percent-encoded paths. |
| IPv6 Address Expander | Expand an IPv6 address to its full eight group form or compress it per RFC 5952, with scope detection and support for embedded IPv4 and zone identifiers. |
| Link | Tool Description |
|---|
| SSL Certificate Information | Decode an X.509 certificate and read every field: subject, issuer, serial, validity, key size, signature algorithm, SHA-256 and SHA-1 fingerprints, subjectAltName entries, key usage and every extension. Includes a hostname check with wildcard and IP handling. |
| SSL Certificate Chain Tester | Paste a chain and have it ordered and verified. Every signature is checked with the Web Crypto API in your browser, so a broken or mismatched link is caught rather than assumed, and missing intermediates, expired certificates, weak algorithms and CA misissuance are all reported. |
Both work on certificates you paste, not on a live host. A browser does not expose the TLS handshake to JavaScript, so reading a certificate from a running server would mean sending your hostname to somebody else’s server. Fetch it first with openssl s_client -connect host:443 -showcerts and paste the result.
| Link | Tool Description |
|---|
| Chmod Command Generator | A menu-based tool that generates chmod commands based on user input for modifying file permissions. |
Some projects grew past a single page and moved to their own subdomains. The Sibling Sites
page covers all seven: Helium Map, Offload Search, OpenRoaming Map, Flock Finder, Eye Spy, Flock-You ESP32, and ATS Resume Match.
