Security & Privacy

Check how strong a password really is — entropy, estimated crack time and the weak patterns attackers look for. Checked privately in your browser.

Generate time-based one-time passwords (TOTP) from a Base32 secret — to test two-factor authentication setups, with SHA-1/256/512, 6–8 digits and custom periods.

Check whether a card number is correctly formatted — Luhn checksum, length and card brand (Visa, Mastercard, Amex, Discover…). For testing forms; nothing is stored or sent.

Paste a site's HTTP response headers to grade its security headers — HSTS, CSP, X-Content-Type-Options, clickjacking protection, Referrer-Policy and Permissions-Policy.

Paste a suspicious email or text message to spot common phishing red flags — urgency, credential requests, gift-card payments, look-alike links and more.

Generate a clear, modern company password policy based on NIST SP 800-63B — length, MFA, breached-password screening, lockouts and password managers.

Generate random, valid MAC addresses (locally administered, unicast) for testing, virtual machines and network privacy — in any common format.

Step-by-step checklist for what to do after identity theft or a data breach — passwords, credit freezes, fraud alerts, reports and monitoring (US, UK and EU).

How to freeze (and unfreeze) your credit at Equifax, Experian and TransUnion — free by law — plus the lesser-known bureaus worth freezing too.

Remove your name, address and phone number from people-search sites — which data brokers to opt out of and how, plus your rights under CCPA and GDPR.

Lock down Facebook, Instagram, TikTok, X, LinkedIn, Snapchat and Google with this checklist of the privacy and security settings that matter most.

A practical checklist for keeping kids safe online — parental controls on iPhone, Android, consoles and YouTube, plus the conversations that matter more than any setting.

Where to find the delete-account option in popular apps — Facebook, Instagram, TikTok, X, Snapchat, Google, Amazon, LinkedIn, Reddit, Discord and more.

Paste a suspicious link to check it for phishing warning signs — lookalike brand names, hidden domains, raw IP addresses, punycode tricks, link shorteners, risky domain endings and urgent 'verify your account' wording. Runs in your browser; the link is never opened.

See what your browser reveals to websites without cookies — canvas and WebGL fingerprints, fonts, screen, time zone and hardware — and how identifiable that makes you.

Calculate SHA-256, SHA-1, SHA-512 and MD5 checksums of any file in your browser — and compare with the published hash to verify a download.

Encrypt any file with a password before sharing or storing it — AES-256-GCM in your browser. Decrypt it here later to get the original file back, name and all.

Share a password or API key with a one-time, end-to-end encrypted link that self-destructs after viewing — instead of pasting it into email or chat.

Send a private message that deletes itself after it's read — encrypted in your browser, viewable once (or up to 10 times), expiring in 1 hour to 7 days.

Encrypt and decrypt messages with a password using AES-256-GCM — right in your browser. Share the scrambled text safely; only someone with the password can read it.

Check whether WebRTC exposes your real or local IP address while using a VPN — see every ICE candidate your browser reveals.

Check whether a website looks trustworthy before you buy or log in — domain age, phishing red flags, HTTPS certificate and security headers in one report, with a plain-English verdict.

Get a security grade for any website — HTTPS, HSTS, Content-Security-Policy, clickjacking protection, cookie flags, mixed content and version disclosure — with fixes for each issue.