Tools
Security tools
Small tools I use in my own security work, free for anyone. They run in your browser, so you can try them with real data.
Nothing you type leaves this page
Password strength checker
Estimates how long a password would survive a real attack. It looks for common passwords, names with numbers added, keyboard patterns, repeats and dates, not only length.
Password and passphrase generator
Uses your browser's secure random number generator. A passphrase of random words is easier to remember and just as hard to guess.
Phishing link checker
Paste a link, or a whole message with links in it. It shows where each link really goes and the warning signs I look for in my phishing research. It never opens the link.
These are rules of thumb, not a verdict. A clean result doesn't prove a link is safe. When in doubt, type the address yourself or open the app instead.
Hash generator
Get the MD5, SHA-1, SHA-256, SHA-384 and SHA-512 hash of text or a file, for example to check a download against the hash its publisher lists.
JWT decoder
Reads a JSON Web Token and points out risky settings, such as no signature algorithm, no expiry or secrets in the payload. It doesn't check the signature, because that needs the server's key.
Found a bug or want another tool? Contact