Security tools have the highest trust requirement of any category — you cannot use a tool whose maker can see your input. Every CipherForces security tool runs entirely in the browser via the Web Crypto API and pure JavaScript, with no server round-trip for the actual cryptographic work. Hash a password, encrypt a file with AES-256, generate HMAC signatures for webhook verification, decode a JWT, generate a strong password, check whether a password has been seen in known breaches (Have-I-Been-Pwned with k-anonymity), audit an SSL certificate. The HMAC Calculator has both a Generate mode and a Verify mode (Stripe webhook debugging is a one-shot operation), and signature comparison uses constant-time equality. The Encryption Tool uses AES-GCM with PBKDF2-derived keys (310k iterations) — same parameters as 1Password and Bitwarden. The Password Generator is local-only, never logged, never transmitted.
Hide your email address from spam scrapers using HTML entity, JavaScript, and reverse-string encoding.
Open toolEncrypt text and files with AES-256. Decrypt with your password.
Open toolVerify file integrity by comparing SHA-256 checksums.
Open toolGenerate SHA-1, SHA-256, SHA-384, SHA-512 hashes for text and files.
Open toolGenerate or verify HMAC signatures (SHA-1, SHA-256, SHA-384, SHA-512). Built for webhook signature debugging.
Open toolDecode a JSON Web Token to inspect its header, payload, and expiry.
Open toolCheck any website's SSL certificate and security headers.
Open toolHash, HMAC, AES, key derivation — all use the browser's native crypto.subtle, which is hardware-accelerated, FIPS-validated on most platforms, and impossible to backdoor without subverting the browser itself.
Breach Checker uses Have-I-Been-Pwned's k-anonymity API: only the first 5 characters of your password's SHA-1 hash leave your browser. The full password and its full hash never transmit.
HMAC Calculator has a dedicated Verify mode for Stripe / GitHub / Twilio / Slack webhook debugging. Paste payload, secret, and the received signature — get an immediate ✓match or ✗no-match with constant-time comparison.
Tools in this category never log inputs. Click counts only. The password you generate, the file you encrypt, the JWT you decode — those stay on your device.
Use the Breach Checker. It hashes your password locally with SHA-1, sends only the first 5 hex characters to the Have-I-Been-Pwned API, and compares the returned suffix list locally. Your full password (and its full hash) never transmit.
Yes — Encryption Tool uses AES-256-GCM with PBKDF2 (310k iterations, SHA-256). Drop a file, set a password, download the .enc output. Same parameters that 1Password and Bitwarden use for their vaults.
Use HMAC Calculator in Verify mode. Paste the raw payload, your endpoint secret, and the received signature header. The tool computes the expected signature locally, compares constant-time, returns match/no-match. Works for Stripe, GitHub, Twilio, Slack, Vercel, and any HMAC-SHA256 webhook.
84 browser-based tools across PDF, image, audio, developer, business, and security categories. All free for daily use; one-time license for unlimited.