Hash, encrypt, sign — without trusting anyone.
Security tools have the highest trust requirement of any category — you cannot use a tool whose maker can see your input. Every CipherForces security tool runs entirely in the browser via the Web Crypto API and pure JavaScript, with no server round-trip for the actual cryptographic work. Hash a password, encrypt a file with AES-256, generate HMAC signatures for webhook verification, decode a JWT, generate a strong password, check whether a password has been seen in known breaches (Have-I-Been-Pwned with k-anonymity), audit an SSL certificate. The HMAC Calculator has both a Generate mode and a Verify mode (Stripe webhook debugging is a one-shot operation), and signature comparison uses constant-time equality. The Encryption Tool uses AES-GCM with PBKDF2-derived keys (310k iterations) — same parameters as 1Password and Bitwarden. The Password Generator is local-only, never logged, never transmitted.
11 security tools.
Diceware Passphrase Generator
Free unlimitedGenerate strong memorable passphrases from the EFF word list. Configurable word count, separators, and entropy display.
Open toolEmail Obfuscator
Free unlimitedHide your email address from spam scrapers using HTML entity, JavaScript, and reverse-string encoding.
Open toolEncrypt & Decrypt
Encrypt text and files with AES-256. Decrypt with your password.
Open toolFile Checksum Verifier
Free unlimitedVerify file integrity by comparing SHA-256 checksums.
Open toolHash Generator
Free unlimitedGenerate SHA-1, SHA-256, SHA-384, SHA-512 hashes for text and files.
Open toolHMAC Calculator
Free unlimitedGenerate or verify HMAC signatures (SHA-1, SHA-256, SHA-384, SHA-512). Built for webhook signature debugging.
Open toolJWT Decoder
Free unlimitedDecode a JSON Web Token to inspect its header, payload, and expiry.
Open toolPassword Generator
Free unlimitedGenerate strong random passwords entirely in your browser. Length, charset, and exclude-ambiguous controls.
Open toolPassword Strength + Breach Checker
Free unlimitedLive strength meter + k-anonymity check against the Have I Been Pwned password database. Your password never leaves your device.
Open toolPrivacy Report Card
Free unlimitedAudit any website's privacy posture — third-party trackers, fingerprinting, HTTPS, headers, cookies, ads.
Open toolSSL Certificate Checker
Free unlimitedCheck any website's SSL certificate and security headers.
Open toolBuilt for privacy, breadth, and speed.
Web Crypto API everywhere
Hash, HMAC, AES, key derivation — all use the browser's native crypto.subtle, which is hardware-accelerated, FIPS-validated on most platforms, and impossible to backdoor without subverting the browser itself.
k-anonymous breach checking
Breach Checker uses Have-I-Been-Pwned's k-anonymity API: only the first 5 characters of your password's SHA-1 hash leave your browser. The full password and its full hash never transmit.
Webhook signature debugging
HMAC Calculator has a dedicated Verify mode for Stripe / GitHub / Twilio / Slack webhook debugging. Paste payload, secret, and the received signature — get an immediate ✓match or ✗no-match with constant-time comparison.
No telemetry on cryptographic input
Tools in this category never log inputs. Click counts only. The password you generate, the file you encrypt, the JWT you decode — those stay on your device.
People ask these things.
How do I check if my password has been breached?
Use the Breach Checker. It hashes your password locally with SHA-1, sends only the first 5 hex characters to the Have-I-Been-Pwned API, and compares the returned suffix list locally. Your full password (and its full hash) never transmit.
Can I encrypt a file in my browser?
Yes — Encryption Tool uses AES-256-GCM with PBKDF2 (310k iterations, SHA-256). Drop a file, set a password, download the .enc output. Same parameters that 1Password and Bitwarden use for their vaults.
How do I verify a webhook signature?
Use HMAC Calculator in Verify mode. Paste the raw payload, your endpoint secret, and the received signature header. The tool computes the expected signature locally, compares constant-time, returns match/no-match. Works for Stripe, GitHub, Twilio, Slack, Vercel, and any HMAC-SHA256 webhook.
Explore more tools.
See every tool we ship.
83 browser-based tools across PDF, image, audio, developer, business, and security categories. All free for daily use; one-time license for unlimited.