Security Tools

Eighteen security tools, and a page that never sends your secret anywhere

Every tool on this site was picked because the obvious place to do it is a website, and a website is the worst possible place: the input is a password, a key, a token, a certificate or a file you would be sacked for pasting. This page carries the whole tool as WebAssembly and runs it on your own device. There is no server to send anything to, and none of the tools makes a network request while it works — which you can watch in your browser's network panel.

Passwords first: what one is actually worth and why the number is an upper bound rather than a value, a policy tester that says out loud that a composition rule is a cost, a passphrase generator whose entropy is the size of your list and not the length of the words, a PIN generator that refuses the four shapes filling the top of every leak, and a check against a list you supply — because a usable list of common passwords is larger than this whole application, and a short one says "uncommon" about a password that is not.

Then the codes a second factor is made of: TOTP and HOTP against the published vectors, the address a phone scans, and backup codes in an alphabet with the misread characters left out. Then what a signature is: HMAC, subresource integrity with the attribute that silently turns it off, a basic authentication header that says Base64 is not encryption, and an htpasswd line that says which of its schemes are bad. Then keeping a secret — a message under a password, and a secret split so that any few of the parts rebuild it. Last, looking at what you already have: a certificate read without its signature being checked, a scan for published key prefixes, a sweep for personal data, and the four alphabets that are not encryption either.

What a password is worth

Password entropy
What a password could be worth at most, and what that buys.

Password policy tester
Which rule a password failed, and what the rules themselves cost.

Secure PIN generator
Numbers with the patterns a person would pick taken out.

Passphrase generator
A phrase from your own word list, with the entropy it actually has.

Common password check
Whether a password is in a list you paste. Nothing is sent anywhere.

One-time codes

TOTP code
The code a secret gives at a time you name, and the steps either side.

Authenticator code
The address an authenticator scans, drawn as a code on this device.

Backup codes
Codes for the drawer, with the hashes a server should keep instead.

Keyed digests

HMAC generator
A signature over a message with a key, and a check of one you were given.

Subresource integrity
The digest a browser checks a script against, and the whole tag round it.

Basic auth header
A name and a password as a header, and back — and why that is not hiding it.

Htpasswd line
A line of a web server's password file, with the scheme it cannot write named.

Keeping a secret

Text encryption
AES-GCM under a password, on this device. Not audited, and it says so.

Secret sharing
A secret split so that any few of the shares rebuild it and fewer say nothing.

Looking at what is there

Certificate decoder
What a certificate says about itself. The signature is not checked, and it says so.

Secret scanner
Keys and tokens with a published shape, found in a pasted file.

Personal data check
Addresses, cards and numbers in a file, and a masked copy of it.

Base32 and Base58
The same bytes in five alphabets, and what each one was invented for.

Questions

Which tools from the group are missing?: The ones that generate a long-term key: an RSA or SSH key pair, a signing request, a self-signed certificate, an OpenPGP message. Every one of those needs big-integer or elliptic-curve arithmetic written from scratch here, and a key you will rely on for years is exactly the wrong thing to take from an unaudited implementation in a web page. They are named here rather than left for you to look for.
Why is the entropy figure called an upper bound?: Because it is the most a password of that shape could be worth, not what it is worth. `password1` scores forty-six bits by the same arithmetic and appears in every list ever published, where it is worth about one guess. The figure is useful for comparing two passwords you invented; it says nothing about one somebody else has already used.
Can the certificate reader tell me a certificate is valid?: No, and it says so on every result. Checking a signature needs RSA or elliptic-curve arithmetic this page does not carry, so everything it shows is what the file says about itself — which a forged file would say too. What it is good for is the questions a browser actually asks: the dates, the alternative names, the signature algorithm, and the fingerprint you can compare against one you were given.
What does it mean when a tool says a code protects nothing?: That an alphabet is not a cipher. Base32, Base58, Base64 and Base85 are ways of writing bytes down; anybody can read them back. They are here because they are genuinely useful — a secret you have to read aloud, a hash you have to write by hand — and because calling a Base64 string "encoded" has got past more than one code review.

This tool failed to start