6 Free Security Tools
Password Generator, Hash, UUID & JWT Decoder

Yes. All processing happens in your browser -- nothing is sent to any server. Hashes are computed locally, passwords are generated locally, and JWT tokens are decoded locally.

The Hash Generator supports MD5, SHA-1, SHA-256, SHA-384, and SHA-512. You can hash a text string or upload a file directly. It also supports HMAC signing with a secret key, Base64 output toggle, and a Hash Verify tab to confirm whether an input matches a known hash. Useful for checksums, API signature verification, and data integrity checks.

A UUID (Universally Unique Identifier) is a 128-bit ID used in databases, APIs, and distributed systems to uniquely identify records. The UUID Generator produces v1 (time-based), v4 (random), v5 (namespace + name), v7 (time-ordered random), and Nil UUIDs. Generate up to 500 at once and download as TXT, CSV, or JSON. Format options include uppercase, no-hyphens, braces, and URN. The built-in UUID Validator detects the version of any UUID you paste in.

Yes. The JWT Decoder takes any Bearer token or raw JWT, decodes the header and payload, and displays the claims in readable JSON -- no library or backend needed. It also verifies signatures using HMAC (HS256/384/512), RSA (RS256/384/512), and ECDSA (ES256/384/512) algorithms.

Use the Password Generator. It has 5 modes: Random (character-based with uppercase, lowercase, numbers, and symbols), Passphrase (word-chain format that is easy to remember), PIN (numeric), and Memorable (easy-to-type patterns). Each generated password shows a crack-time estimate and is saved to a session history. Use passwords of at least 16 characters for important accounts.

Yes. The Password Strength Checker includes a breach check. It uses the k-Anonymity model: only the first 5 characters of your password's SHA-1 hash are sent to the API, and your full password is never transmitted. If the hash appears in the breach database, you will see a warning with the number of times it has been exposed.

UUID v4 is the safest default -- it is fully random and works in any system. Use v1 if you need time-based sortability. Use v5 when you need a deterministic UUID from a namespace and name (same inputs always produce the same UUID). Use v7 for modern database primary keys -- it is time-ordered like v1 but uses random bits instead of a MAC address, giving you good index performance without privacy trade-offs.

Use the Random String Generator. It produces cryptographically secure strings of up to 2048 characters. Format presets include API key, JWT secret, hex, UUID, and alphanumeric. Enable passphrase mode for readable multi-word strings, turn on no-duplicates to avoid repeats in bulk output, and see the entropy value for every generated string. Download the full batch as a .txt file.