Security & encryption

Encrypt and decrypt text with AES-256-GCM using a passphrase-derived key (PBKDF2 SHA-256, random salt), entirely in your browser with no uploads.

Hash a password with Argon2id or scrypt and verify an Argon2 hash against a password, entirely in your browser.

Generate a bcrypt password hash from plain text at a chosen cost factor, or verify a password against an existing bcrypt hash, entirely in your browser.

Generate a random BIP39 recovery phrase of 12 to 24 words in several languages, or convert an existing mnemonic back into its raw entropy, entirely in your browser.

Generate an RSA or ECDSA private key together with a certificate signing request or a self-signed X.509 certificate, all in your browser.

Generate ECDSA (P-256/P-384) or Ed25519 key pairs and sign or verify messages, exported as PEM or JWK, entirely in your browser.

Compute an HMAC from a message and secret key using SHA-1, SHA-2 or SHA-3, verify it against an expected signature, and output hex or Base64 — all in your browser.

Build an Apache or nginx .htpasswd line and an HTTP Basic Authorization header from a username and password, with bcrypt, APR1, or SHA-1 hashing, entirely in your browser.

Decode JWTs, verify HS, RS and ES signatures with a secret or PEM public key, and sign new HS tokens — all entirely in your browser.

Create strong, random passwords with adjustable length, lowercase, uppercase, digit and symbol sets, and ambiguous-character filtering, all in your browser.

Score any password from 0 to 4 and see its entropy, estimated crack time, and concrete improvement tips, all computed in your browser.

Derive a key from a password or secret with PBKDF2 or HKDF, choosing the salt, iteration count or info label, hash, and output length, and read it back as hex or base64, entirely in your browser.