Security & Privacy

Diceware-style passphrases from a curated wordlist — easy to type, hard to crack, generated with WebCrypto.

Generate cryptographically random numeric PINs from 4 to 16 digits — perfect for bank cards and door locks.

Measure the true entropy of any password in bits — the real metric for password strength.

Generate a SHA-based htpasswd line for Apache and Nginx basic authentication — right in your browser.

Split any secret into two random shares using a one-time-pad — both parts are required to reconstruct it.

Generate a secure random numeric PIN — 3 to 12 digits — for door codes, safes and 2FA fallbacks.

Paste a suspicious email, SMS or WhatsApp message to get a red-flag breakdown: urgency language, spoofed domains, OTP requests and payment demands.

Free temp mail — get an instant temporary email address that receives activation links, OTP codes and messages in real time. Auto-refresh, no signup.

Free public temporary phone numbers from US, UK, Canada, France and Germany to receive SMS and OTP verification codes online without exposing your real SIM number.

Inspect any website's HTTP security headers — HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy. Scored report with severity levels and recommended fixes.

Check any domain's SSL/TLS certificate: expiry date, days remaining, issuer, subject, SANs and chain validity. Instant results without installing anything.

Look up and analyse any domain's SPF DNS record. Shows the raw TXT record, parsed mechanisms, include chain, softfail vs hardfail policy, and common configuration mistakes.

Verify a domain's DKIM public-key DNS record by selector and domain. Displays key type, bit length, hash algorithms, service type and flags. Validates against RFC 6376.

Fetch and decode a domain's DMARC record. Explains the policy, subdomain policy, reporting URIs, percentage, alignment modes and what each tag means.

Identify the algorithm behind an unknown hash string. Recognises MD5, SHA-1, SHA-224, SHA-256, SHA-384, SHA-512, bcrypt, Argon2, PBKDF2, NTLM and 20+ more by length and character set.

Test a URL's CORS configuration. Shows Access-Control-Allow-Origin, methods, headers, credentials policy, and preflight behaviour. Identifies over-permissive wildcard configurations.

Deep-inspect every claim in a JWT: expiration countdown, issued-at time, not-before window, issuer, audience, subject and all custom claims with human-readable timestamps. Client-side only.