Security Tools
Hashing, ciphers, certificates, and other free utilities for security professionals.
84 tools
Command builders & CLI3
CrowdStrike Falcon Command Builder
Generate CrowdStrike Falcon sensor commands for Windows, macOS and Linux - install, uninstall, verify, restart, proxy and grouping tags. Tokens stay local.
Metasploit Command Builder
Build Metasploit msfconsole command sequences from module presets, payload and option selectors. For authorised penetration testing and lab use only.
Nmap Command Builder
Build Nmap commands from checkboxes - scan type, ports, service and OS detection, NSE scripts, timing - and parse scan output into a readable host table.
Formatters & validators3
Email Authentication Validator
Free DMARC checker. Look up and validate your DMARC record, plus SPF and DKIM, with policy grading and specific fixes to stop email spoofing.
Email Validator & MX Checker
Check email syntax, MX records, disposable domains and role accounts in seconds. Bulk-validate up to 10,000 addresses from CSV. Free, with an API.
Kubernetes Manifest Validator
Paste Kubernetes YAML and get security findings by severity: privileged containers, runAsRoot, hostPath, missing limits, :latest tags. Markdown/JSON/SARIF.
Encoders, hashing & IDs19
Affine Cipher Tool
Encode and decode affine ciphers with E(x) = (ax + b) mod 26, or brute-force all 312 keys ranked by English letter frequency. Free, runs in your browser.
Atbash Cipher Tool
Encode and decode Atbash - the keyless A-Z reversal cipher (A becomes Z, B becomes Y). Self-inverse, instant, with a live alphabet map. Free, in-browser.
Base64 Encoder/Decoder
Free Base64 encoder and decoder tool. Convert binary data to ASCII text and back for email attachments, APIs, and data serialization.
Beaufort Cipher Tool
Encode and decode Beaufort ciphers with one operation. C = (K - P) mod 26 is self-reciprocal. Vigenere comparison, tabula recta, and cryptanalysis tools.
Caesar Cipher Decoder & Encoder
Decode or encode any Caesar shift cipher instantly. Brute-force all 26 shifts, rank by English score, use the cipher wheel. Free, in-browser, no signup.
Cipher Identifier Tool
Paste unknown ciphertext and instantly see which cipher it is. Free browser-based detector using Index of Coincidence, chi-squared and frequency analysis.
Cipher Suite - Encryption Tools Collection
Twelve free classical cipher tools: Caesar, Vigenere, substitution, Playfair, Hill, XOR, Rail Fence and more, plus an identifier for unknown ciphertext.
File Hash Checker & Malware Hash Lookup
Check any file hash in seconds. Paste an MD5, SHA-1 or SHA-256 hash, or drop a file to hash it locally, then check it against live malware feeds.
Hash Generator - MD5, SHA-256, SHA-512
Free online hash generator. Compute MD5, SHA-1, SHA-256, SHA-512, SHA-3, bcrypt and HMAC from text or files — all in your browser, nothing uploaded.
Hash Type Identifier
Free hash identifier. Paste a hash to identify MD5, SHA-1, SHA-256, bcrypt, NTLM and more, with the exact hashcat -m mode and John the Ripper format.
Hill Cipher Tool
Encrypt and decrypt with 2x2 or 3x3 Hill cipher key matrices. Automatic modular inverse, determinant validation and step-by-step block arithmetic.
JWT Decoder & Validator
Decode and inspect JWT tokens instantly. View header, payload, and verify signatures. Security validation included. Free, works in your browser.
Playfair Cipher Tool
Encrypt and decrypt Playfair digraphs with a live 5x5 key square. Choose I/J merging, set the padding letter and see the three rules applied.
Rail Fence Cipher Tool
Encode, decode and brute-force the rail fence zigzag cipher with a live fence diagram. A transposition cipher - letters move, not change. Free, in-browser.
ROT13 Decoder & Caesar Cipher Solver
Free ROT13 decoder and encoder. Decode or encode ROT13 instantly in your browser, use any Caesar shift 1–25, and brute-force all 26 shifts at once.
Substitution Cipher Solver
Free cipher decoder and substitution cipher solver. Auto-solve cryptograms, plus frequency, bigram and word-pattern analysis. Runs in your browser.
Vigenère Cipher with Cryptanalysis
Encode and decode Vigenere ciphertext, or break it without the key using Kasiski examination, index of coincidence and automatic key recovery.
X.509 Certificate Decoder
Decode any X.509 certificate free. Paste PEM, upload .crt/.cer/.der, or fetch by domain to view subject, SANs, issuer, expiry and fingerprints.
XOR Encryption Tool
Decrypt XOR ciphertext without the key: brute-force single-byte keys, break repeating-key XOR, crib-drag known plaintext. Text, hex or Base64, in-browser.
Config & file generators10
Certificate CSR Generator & Format Converter
Generate a CSR or self-signed certificate with RSA or ECDSA keys, convert between PEM, DER, PFX and P7B, and verify chains. All in your browser.
CSP Generator
Free CSP generator tool. Create custom Content Security Policy headers to prevent XSS attacks, clickjacking, and code injection.
DMARC Generator
Free DMARC generator tool. Create custom DMARC DNS records with monitoring and enforcement policies to prevent email spoofing.
Email Template Generator
Fill in and copy 11 ready-made IT email templates for incidents, DR tests, maintenance, security advisories, and executive briefings. Free, in-browser.
Incident Response Playbook & Runbook Generator
Generate an incident response playbook or operational runbook from twelve templates. Add your contacts, roles and frameworks, export to Markdown or PDF.
PGP Key Generator
Generate an OpenPGP key pair in your browser. Curve25519, NIST curves or RSA up to 4096-bit, with passphrase and expiry. Key never leaves your device.
SBOM Generator
Generate Software Bill of Materials in SPDX and CycloneDX formats. Document dependencies for supply chain security.
Secure Password Generator
Free secure password generator. Create cryptographically strong random passwords with custom length and character options.
SPF Generator
Build a valid SPF record from 50+ email providers with a live DNS lookup counter and validation. Stay under the 10-lookup limit before you publish.
SSH Key Generator - Ed25519, RSA, ECDSA
Generate an Ed25519, RSA or ECDSA SSH key pair instantly — free and 100% in-browser. OpenSSH, PEM and PuTTY .ppk export with SHA-256 fingerprint.
Visualizers & playgrounds5
Biometric Performance Simulator
See how the matching threshold trades false accepts against false rejects. Compare iris, palm vein, fingerprint, face and voice, then export a PDF.
Cryptographic Mode Visualizer
See why ECB mode leaks image patterns and CBC does not. Interactive side-by-side view of block cipher modes, plus an ECB, CBC, CTR and GCM comparison.
Database Inference & Aggregation Simulator
Run aggregate queries on sample databases and see how SUM, AVG and COUNT leak individual records. Toggle cell suppression, noise and query restriction.
Enigma Machine Simulator
Interactive Enigma machine simulator with authentic WWII rotor configurations. Encrypt and decrypt messages, configure plugboard and reflector settings.
RSA Playground
Generate RSA keys from small primes, encrypt and decrypt with modular exponentiation, then factor n to see why key size matters. Interactive, in-browser.
Testers & inspectors20
Certificate Transparency Lookup
Search Certificate Transparency logs to find all SSL/TLS certificates issued for a domain. Monitor for unauthorized certificates.
Cookie Analyzer
Paste a cookie or Set-Cookie header and analyze it instantly: Secure, HttpOnly, SameSite, expiry, size. Scored findings with CWE refs. Free, in-browser.
CORS Policy Analyzer
Analyze CORS policies for security misconfigurations. Test origin validation, credentials handling, and get remediation guidance.
CVE Vulnerability Search
Search the CVE database free. Look up any CVE ID, filter by vendor, severity or year, see CVSS, KEV and EPSS scores. Instant, no signup.
CWE Lookup Tool
Free CWE lookup. Search MITRE's Common Weakness Enumeration by ID, name or description — CWE-20, CWE-200, CWE-79 and the CWE Top 25, with mitigations.
Domain Risk Scanner
Free online website vulnerability scanner. Check SSL/TLS, security headers, email authentication, DNS and breach exposure for one clear risk score.
Email Header Analyzer
Free email header analyzer. Paste raw headers to trace every hop, check SPF, DKIM and DMARC, and spot spoofing. Runs in your browser, nothing uploaded.
Email Security Gateway Checker
Free email security gateway checker. Find which gateway protects a domain, and grade MTA-STS, TLS-RPT, DANE and DNSSEC. Passive DNS only, no probing.
Encoding Chain Analyzer
Decode nested encodings automatically. Detects Base64, URL encoding and hex through multiple layers and shows every decoding step. Free, in-browser.
Entropy Analyzer
Calculate Shannon entropy for any file in your browser. Get an 0-8 score, per-1KB entropy graph, and byte distribution to spot packed or encrypted data.
File Magic Number Checker
Check a file's magic bytes to reveal its real type. Free in-browser signature checker with hex dump, extension-spoofing alerts and a magic number list.
IP Risk Checker
Check any IP address risk score instantly. Free IP reputation checker: VPN, proxy, Tor and data centre detection, ASN, geolocation and export.
OAuth/OIDC Debugger
Debug OAuth 2.0 and OpenID Connect flows. Decode JWTs, generate PKCE challenges, validate redirect URIs, and troubleshoot OAuth errors.
OCSP/CRL Revocation Checker
Paste an X.509 certificate to extract its OCSP responder and CRL distribution point URLs plus subject, so you can run the revocation check yourself. Free.
Password Strength Checker
Test how strong your password is instantly. Free in-browser password strength checker: 0-100 score, entropy, crack time and breach check.
Phishing Email Analyzer
Check if an email is phishing. Paste it for a risk score with every red flag explained - link mismatches, lookalike domains, urgency. Nothing is uploaded.
Robots.txt Analyzer
Parse and validate robots.txt, test whether a URL is blocked for any crawler, catch security mistakes, and generate a new file from presets.
Secrets Scanner Simulator
Scan code and config for leaked API keys, tokens, private keys, and database credentials with 51 patterns. 100% in-browser - nothing is ever uploaded.
Security Headers Analyzer
Scan any URL for CSP, HSTS, X-Frame-Options, Referrer-Policy and 9 more security headers. Get a weighted score, letter grade and specific fixes. Free tool.
SSL/TLS Checker
Check any domain's SSL/TLS certificate: expiry, chain completeness, SANs, protocol support and cipher strength, with a graded score and fix list.
More tools24
AES Encryption Tool
Encrypt and decrypt text or files with AES-256, 192 or 128 in GCM, CBC or CTR mode. Free, instant, runs entirely in your browser.
Certificate Chain Builder
Paste your SSL certificate and build the complete chain. Fetches missing intermediates via AIA, orders leaf to root, and exports a server-ready PEM bundle.
CVSS v3.1 Calculator
Free CVSS 3.1 calculator. Set Base, Temporal and Environmental metrics for an instant score, severity rating and vector string. Paste a vector to edit it.
Domain Spoofing Detection Tool
Check a domain for homograph attacks and typosquatting, with RDAP registration age, DNS, Certificate Transparency and Wayback history in one report.
Email Setup Wizard
Build correct SPF, DKIM and DMARC records step by step. Live DNS lookup, the 10-lookup SPF limit, safe qualifiers and a monitoring-first DMARC rollout.
Federated Identity Architect
Score SAML, OpenID Connect, OAuth 2.0, Kerberos and WS-Federation against your environment, compare auth flows, and fix eight Kerberos failure modes.
Hex Editor
Open, inspect and edit binary files in your browser. Hex + ASCII view, byte editing, hex/text search, data inspector, code export. Free, nothing uploaded.
IOC Extractor
Free IOC extractor tool. Extract IP addresses, domains, URLs, file hashes, and email addresses from security logs and threat reports.
Machine Code to Assembly Disassembler
Disassemble hex or Base64 machine code to assembly free. x86, x64, ARM, ARM64, RISC-V, MIPS, PowerPC, SPARC, 68K - instant, in your browser.
Malware Deobfuscator
Free online deobfuscator for Base64, hex, XOR, ROT and URL-encoded strings. Auto-detects the encoding, brute-forces XOR keys, decodes PowerShell payloads.
Media Sanitization & Destruction Advisor
Get a NIST SP 800-88 Clear, Purge or Destroy recommendation from media type, data classification and disposition, with a PDF and certificate template.
MITRE ATT&CK Navigator
Browse MITRE ATT&CK Enterprise tactics, techniques, and sub-techniques in a matrix or list view. Search by ID, name, or description for threat hunting.
NIST CSF Mapper
Browse NIST CSF 2.0 by function and map every subcategory to CIS Controls v8, ISO 27001:2022 and SOC 2 criteria. Search both ways, export CSV free.
One-Time Pad Generator
Generate one-time pad keys and encrypt with perfect secrecy. Cryptographically random keys, XOR encode and decode, and notes on using a pad safely.
Phishing Risk Assessment
Free phishing risk self-assessment. Score your security awareness training, email controls, MFA and BEC defences, and get a prioritised action list.
PII Redactor
Redact PII from text and logs before you share them. Masks emails, SSNs, credit cards, phone numbers, IPs and API keys locally - nothing is uploaded.
Public Key Concepts
Understand public and private keys through three interactive analogies - padlock, colour mixing and mailbox - plus where asymmetric crypto is used daily.
Security Model Decision Matrix
Compare Bell-LaPadula, Biba, Clark-Wilson, Brewer-Nash, Graham-Denning and HRU. Score them against your requirements and export the result as a PDF.
SIEM Query Builder
Build the same detection in Splunk SPL, Elastic KQL and Microsoft Sentinel KQL at once. 30+ MITRE-tagged presets and a full field-mapping reference.
String Extractor
Extract ASCII and UTF-16 strings from any binary with byte offsets. Auto-flags IPs, URLs, registry keys, paths and base64. Runs locally, nothing uploaded.
SystemLens
Free open-source desktop app for macOS, Windows and Linux that maps disk usage and audits filesystem permissions, with agentless remote SSH scanning.
Threat Intelligence Aggregator
Aggregate and deduplicate IOCs - IPs, domains, URLs, hashes - search across feeds, look up indicators via OTX and AbuseIPDB, and export CSV, JSON or STIX.
Threat Modeling Wizard
Build a full threat model in six steps: profile, data flow, STRIDE threats, DREAD scoring, mitigations, and PDF export. 39-threat library. Free in-browser.
URL Defanger Tool
Defang a URL, IP, domain or email instantly, or refang defanged IOCs back. CyberChef hxxp/[.] style, bulk paste, 100% in your browser. Free, no signup.