Security Tools
Security tooling is exactly where you shouldn't paste data into a random website — so every tool here runs entirely in your browser using the Web Crypto API. Keys, secrets, certificates, and passwords are generated or processed locally and never transmitted.
Use them to test a 2FA integration with live TOTP codes, generate SSH or JWT signing keys, hash and verify passwords with bcrypt, inspect a TLS certificate's expiry and SANs, build a Content-Security-Policy, or scan code for hardcoded API keys before it reaches git.
16 security tools
AES / RSA Encryption
Encrypt and decrypt text using AES-GCM and RSA-OAEP
CSP Header Builder & Analyzer
Build a Content-Security-Policy header visually, or paste one to check for unsafe directives
JWT Key Pair Generator
Generate RSA and ECDSA key pairs for signing JWTs — PEM and JWK formats
SSH Key Generator
Generate Ed25519 and RSA SSH key pairs in OpenSSH format, entirely in your browser
TOTP / 2FA Code Generator
Generate live TOTP authentication codes from a secret key — test 2FA integrations in your browser
HOTP Generator
Generate RFC 4226 counter-based one-time passwords — TOTP's time-independent sibling
2FA Backup Codes Generator
Generate one-time recovery codes for account 2FA setup, plus their SHA-256 hashes for server-side storage
package.json Script Inspector
See exactly which scripts run automatically on install, and which dependencies aren't pinned
HTTP Security Headers Checker
Paste raw response headers and check them against HSTS, CSP, X-Frame-Options, and more
JWK ↔ PEM Converter
Convert cryptographic keys between JWK and PEM formats
Secret / API Key Scanner
Paste code or a config file and find hardcoded API keys, tokens, and credentials before they reach git
Password Strength Checker
Check how strong a password actually is — entropy, common-password matches, and predictable patterns
JWK Thumbprint Calculator
Compute an RFC 7638 thumbprint for a JSON Web Key — the canonical fingerprint used as a stable kid
Passkey / WebAuthn Playground
Create a real passkey and run an authentication ceremony entirely in your browser — no server required
Bcrypt Hash Generator & Verifier
Hash a password with bcrypt, or verify a password against an existing hash — entirely in your browser
X.509 / PEM Certificate Decoder
Paste a PEM certificate or chain to see subject, issuer, expiry, SANs, key details, and fingerprints
Guides
🧶 npm ERR! code ERESOLVE unable to resolve dependency tree — How to Fix It
What npm's ERESOLVE error actually means, how to read the Found / Could not resolve lines, and the right fix for each case — upgrading, overrides, or (carefully) --legacy-peer-deps.
🔐 How to Set Up 2FA the Right Way: TOTP, Backup Codes, and What Actually Breaks
A practical guide to implementing two-factor authentication correctly — why TOTP beats HOTP for most cases, how backup codes should actually be stored, and the handful of mistakes that account for nearly every real-world 2FA bug report.
🔑 How to Test Passkeys (WebAuthn) Without Building a Backend First
A practical, step-by-step guide to running real WebAuthn registration and authentication ceremonies in your browser — no relying-party server required — plus what the flags in the response actually mean.
🔑 Why Hardcoded Secrets Still End Up in Git — and How to Actually Catch Them
Hardcoded API keys and credentials remain one of the most common security findings in real codebases. Here's what the common secret formats actually look like, why regex-based scanning works (and where it doesn't), and how to stop a leak before it's committed.
🔑 SSH "Permission Denied (publickey)": The Real Causes and How to Fix Each One
This error hides at least six different root causes behind one generic message. Here's how to tell which one you're actually looking at, with the exact commands to diagnose and fix each.
🛡️ Content-Security-Policy: The 'unsafe-inline' Mistake 87% of Sites Make
Most CSP headers in the wild include 'unsafe-inline' in script-src — which quietly disables the exact XSS protection CSP exists to provide. Here's why it happens and what to do instead.