Validate JSON
Validation
—
Paste JSON above.
Base64 Encoder / Decoder
Base64 encode / decode
Privacy: runs entirely in your browser.
Output
—
SHA-256 Hash Generator
SHA-256 hash
Privacy: nothing is uploaded. Text and files are hashed locally.
SHA-256 (hex)
—
0 bytes · SHA-256 always produces a 64-hex-character digest.
Password Leak Checker
Has this password been leaked?
Privacy promise: your password is hashed locally with SHA-1 and only the first 5 hex characters of the hash are sent to the Have I Been Pwned API (k-anonymity). HIBP never sees your full hash or password.
Result
—
—
Secure Passphrase Generator
Generate a passphrase
Privacy: runs entirely in your browser.
Your passphrase
—
— · —
Password Generator
Generate a secure password
Privacy promise: this runs entirely in your browser using
window.crypto.getRandomValues. Nothing is sent to our servers.
Your password
—
Entropy: — bits · —
Email Header Analyzer
Paste email headers
Gmail: open the message → three-dot menu → "Show original" → copy everything from Delivered-To: down to the blank line before the body. Outlook: File → Properties → Internet headers.
Verdict
—
Paste headers above and click Analyze.
SPF
—
—
DKIM
—
—
DMARC
—
—
From / Reply-To / Return-Path
| From | — |
|---|---|
| Reply-To | — |
| Return-Path | — |
| Subject | — |
Password Strength Checker
Test a password
Privacy promise: this entire tool runs in your browser. The password you type is never sent over the network or written to disk.
Strength
—
Type a password above to see its score.
Length
0 characters
0 characters
Charset size
0 possible chars
0 possible chars
Entropy
0 bits
0 bits
Crack-time assumes a modern offline GPU attacker (~10^11 guesses/sec). Online services with rate limits will take much longer to crack the same password.
Phishing Link Checker
Check a link
Paste a full URL (https://...). Works on links from email, SMS, WhatsApp, social media — anything you've been asked to click.
Risk score
—
Enter a URL above and click Analyze.
Important: a low risk score doesn't guarantee the page is safe — it only means the standard phishing signals didn't fire. When in doubt, type the brand's known URL into your browser instead of clicking.