Security tools answer different questions: whether a password appears in a breach dataset, whether a token contains expected claims, or which headers a website returns. Choose the check that fits the question. A single result does not establish that an account, file, or website is secure.
Password Security Tools
Generate and Test Passwords
The Password Generator creates passwords with configurable length and character sets. Its random selection uses crypto.getRandomValues(). Store the result in an approved password manager.
The Password Strength Checker estimates strength from the supplied password and its model. A displayed crack time is an estimate, not a prediction. Use a unique password and an approved password manager.
The Password Breach Checker uses the Have I Been Pwned range-query method. That operation sends five hexadecimal characters from a SHA-1 hash, then compares the returned suffixes locally. See the Pwned Passwords API documentation. Absence from the dataset does not prove that a password is secret.
The Password Pattern Validator tests passwords against configurable policy rules: minimum length, required character types, maximum consecutive characters, and custom regex patterns. Useful for developers building registration forms who need to verify their validation logic matches their security policy.
Encryption and Hashing Tools
Text Encryption
The Text Encryption tool uses AES-256-GCM through the Web Crypto API. It derives a key from a passphrase with PBKDF2 and uses random salt and IV values. Protect the passphrase and verify the intended recipient.
PGP Encryption
The PGP Encryption Tool provides key and message operations through OpenPGP.js. Verify the recipient’s public-key fingerprint before encryption. Use an approved key-management process for long-lived private keys.
Hashing Tools
Hashing converts data into fixed-length fingerprints for integrity verification, password storage, and digital signatures. FindUtils provides five hashing tools:
| Tool | Algorithm | Use Case |
|---|---|---|
| SHA-256 Hash Generator | SHA-256 | Data integrity; not password storage |
| MD5 Hash Generator | MD5 | Legacy checksums, non-security file verification |
| HMAC Generator | HMAC (SHA-256/512) | API authentication, message signing, webhook verification |
| File Hash Calculator | Multiple | Verify downloaded file integrity against published checksums |
| Hash Comparison Tool | Any | Compare two hash values for equality |
The File Hash Calculator is particularly useful: drag in a downloaded file and instantly compute its SHA-256, SHA-512, or MD5 hash to verify against the publisher's checksum. No command line needed.
Key Generation
The Random Key Generator creates cryptographically secure random strings for API keys, tokens, encryption keys, and secrets. Configurable output formats include hex, base64, and alphanumeric. Uses crypto.getRandomValues() — not Math.random() — for true cryptographic randomness.
JWT (JSON Web Token) Tools
JWTs are the backbone of modern web authentication. FindUtils provides three specialized tools for working with them:
The JWT Decoder reveals the token header and payload. Decoding does not verify a signature, establish the issuer, or authorize access. Use a redacted example when sharing a token.
The JWT Generator creates signed JWTs with custom claims, expiration times, and algorithms (HS256, HS384, HS512). Useful for testing API authentication during development.
The JWT Security Validator goes beyond decoding to audit a token's security posture: algorithm strength, expiration status, claim completeness, and known vulnerability patterns (like the alg: none attack). It flags weak configurations that could lead to token forgery.
Website and Domain Security
SSL and HTTPS
The SSL Certificate Checker checks a remote host’s certificate information. Its findings cover the data the service can observe; they do not replace a complete TLS audit.
The Security Headers Analyzer shows header explanations and recommendations. Its current grade uses demonstration values rather than the target response headers. Inspect the actual HTTP response before deciding which headers are present or missing.
DNS and Network
The DNS Lookup tool queries DNS records for any domain: A, AAAA, CNAME, MX, TXT, NS, SOA, and more. Useful for verifying DNS propagation, checking MX records for email delivery, and validating SPF/DKIM/DMARC records.
The DNS Security Scanner inspects selected SPF, DMARC, MX, and CAA records through remote DNS queries. It does not test zone transfers, open resolvers, or DNSSEC validation. Its grade includes assumptions; do not treat it as a complete DNS security assessment.
The IP Address Lookup provides network and approximate location information. The URL Safety Checker checks URL patterns. It does not inspect the destination content or query a live malware database.
Cookie Analysis
The Cookie Analyzer inspects supplied cookie text and Set-Cookie headers. It checks flags such as Secure, HttpOnly, and SameSite. It does not retrieve every cookie from another website or establish legal compliance.
Email and Phone Validation
The Email Validator checks supplied email text with syntax and length rules. It does not query MX records, identify disposable providers, or verify mailbox delivery. A passing result does not prove that an address exists.
The Email Security Checker inspects selected email-security DNS records. A record’s presence does not prove that every sender and receiver enforces the intended policy. Confirm selector-specific DKIM and the actual mail flow.
The Phone Number Validator and E.164 Validator inspect supported number formats. Format validation does not prove that a number is assigned, reachable, or controlled by a person.
Privacy and Compliance Tools
The Privacy Policy Generator drafts policy text from supplied information. Review the draft against actual data practices and applicable legal requirements. A generated document does not establish compliance.
The Privacy Policy Checker helps inspect policy text for missing or unclear topics. It does not give a legal compliance determination.
The Robots.txt Generator writes crawler instructions. Robots rules are not access controls and do not reliably hide sensitive pages from search results. Protect private content with authentication.
Additional Security Utilities
| Tool | What It Does |
|---|---|
| Secure Note Sharing | Local note prototype; do not use for delivery or enforced deletion |
| 2FA Code Tester | Generate and validate TOTP codes for two-factor authentication testing |
| Data Sanitizer | Replace recognized patterns; manually inspect for remaining private data |
Match the security question to the check
| Task | Tool role | Review before use |
|---|---|---|
| Password reuse | Breach lookup | Absence from a dataset does not prove secrecy |
| Password storage | Purpose-built password hashing | A plain SHA-256 or MD5 digest is unsuitable |
| Token inspection | JWT decoder | Verification requires trusted keys and application rules |
| Website configuration | Header, DNS, or certificate check | Remote observations are not a full penetration test |
| Policy drafting | Policy generator | A template does not establish legal compliance |
5 Common Security Mistakes (and How to Fix Them)
Mistake 1: Using MD5 for Password Hashing
Plain MD5, SHA-1, and SHA-256 are unsuitable for password storage. Use a purpose-built password-hashing scheme with reviewed parameters. See the OWASP password-storage guidance.
Mistake 2: Ignoring Security Headers
Headers such as CSP and HSTS can support a security policy when configured correctly. Check compatibility and test enforcement; adding a header does not establish that the application is secure.
Mistake 3: Not Checking JWT Expiration
A missing exp claim removes that token-level expiry check. Access can still depend on application rules, key rotation, and revocation. Validate required claims and allowed algorithms according to JWT best current practices.
Mistake 4: Reusing Passwords Across Sites
Password reuse lets a stolen credential affect more than one account. Use unique passwords and review breach notifications.
Mistake 5: Skipping SPF/DKIM/DMARC
SPF, DKIM, and DMARC help receiving systems assess sending authorization and alignment. Correct deployment reduces some spoofing risks, but does not block every phishing message or impersonation method.
Tools Used in This Guide
- Password Generator — Create cryptographically random passwords
- Password Strength Checker — Evaluate password security with crack-time estimates
- Password Breach Checker — Check if passwords appear in known data breaches
- Password Pattern Validator — Test passwords against configurable policy rules
- Text Encryption — AES-256-GCM encryption and decryption in the browser
- PGP Encryption Tool — PGP key generation, encryption, and decryption
- SHA-256 Hash Generator — Generate SHA-256 hashes for integrity verification
- MD5 Hash Generator — Generate MD5 hashes for non-security checksums
- HMAC Generator — Create HMACs for API authentication and message signing
- File Hash Calculator — Verify file integrity against published checksums
- Hash Comparison Tool — Compare hash values for equality
- Random Key Generator — Generate cryptographically secure API keys and tokens
- JWT Decoder — Decode and inspect JWT claims without server upload
- JWT Generator — Create signed JWTs for development testing
- JWT Security Validator — Audit JWT security posture and vulnerability patterns
- SSL Certificate Checker — Inspect SSL/TLS certificates, chains, and protocols
- Security Headers Analyzer — Explain security headers; the current grade uses demonstration values
- DNS Lookup — Query all DNS record types for any domain
- DNS Security Scanner — Inspect selected SPF, DMARC, MX, and CAA records
- IP Address Lookup — Resolve IPs to location, ISP, and ASN
- URL Safety Checker — Inspect URL patterns; no destination or malware scan
- Cookie Analyzer — Inspect flags in supplied cookie text
- Email Validator — Check email syntax and length; no MX or mailbox lookup
- Email Security Checker — Audit SPF, DKIM, DMARC, and MTA-STS configuration
- Phone Number Validator — Validate international phone number formatting
- E.164 Validator — Verify E.164 international phone number standard
- Privacy Policy Generator — Draft privacy policy text for review
- Privacy Policy Checker — Inspect policy text for topics that need review
- Robots.txt Generator — Create properly formatted robots.txt files
- Secure Note Sharing — Local note prototype; recipient delivery is not established
- 2FA Code Tester — Generate and validate TOTP two-factor codes
- Data Sanitizer — Replace recognized text patterns; inspect the result
FAQ
Q1: Does every security tool run locally? A: No. DNS and certificate checks contact remote services. The URL Safety Checker uses local URL patterns. Check each operation before entering private data.
Q2: How does the password breach lookup reduce disclosure? A: It sends the first five hexadecimal characters of a SHA-1 hash, then compares returned suffixes locally. It does not send the full password.
Q3: Can I use plain SHA-256 to store passwords? A: No. Use a suitable password-hashing scheme and reviewed parameters. See the OWASP guidance linked below.
Q4: Does decoding a JWT validate it? A: No. Decoding only reveals fields. Verification must check the signature, allowed algorithm, and required claims.
Q5: Does a generated privacy policy prove compliance? A: No. The text must match actual data practices and applicable requirements.
Q6: What does a passing website check prove? A: It proves only the conditions the tool checked at that time. Review scope and evidence before drawing a wider conclusion.
What to Read Next
- Free Developer Tools That Replace Paid Software — Developer utilities including JWT and API tools
- Password Generator — Create strong, unique passwords instantly
- SSL Certificate Checker — Verify any domain's SSL/TLS configuration
- Security Headers Analyzer — Review header definitions and demonstration recommendations
