Hash, encrypt, sign — without trusting anyone.
Security tools have the highest trust requirement of any category — you cannot use a tool whose maker can see your input. Every CipherForces security tool runs entirely in the browser via the Web Crypto API and pure JavaScript, with no server round-trip for the actual cryptographic work. Hash a password, encrypt text with AES-256, generate HMAC signatures for webhook verification, decode a JWT, generate a strong password, check whether a password has been seen in known breaches (Have-I-Been-Pwned with k-anonymity), audit an SSL certificate. The HMAC Calculator has both a Generate mode and a Verify mode (Stripe webhook debugging is a one-shot operation), and signature comparison uses constant-time equality. The Encryption Tool uses AES-GCM with PBKDF2-derived keys (310k iterations) — same parameters as 1Password and Bitwarden. The Password Generator is local-only, never logged, never transmitted.
22 security tools.
Analyze Email Headers
Free unlimitedPaste raw email headers to see the delivery path, per-hop delays, and whether SPF, DKIM, and DMARC actually passed.
Open toolBcrypt Generator
Free unlimitedHash a password with bcrypt at any cost factor, and verify a password against an existing bcrypt hash.
Open toolCSR & Private Key Generator
Free unlimitedCreate a private key and certificate signing request (or self-signed cert) right in your browser — no OpenSSL required.
Open toolDecode SSL Certificates
Free unlimitedRead every field of an X.509 certificate or CSR — subject, validity, SANs, key usage, and fingerprints.
Open toolDiceware Passphrase Generator
Free unlimitedGenerate strong memorable passphrases from a curated 512-word list. Configurable word count, separators, and entropy display.
Open toolEmail Obfuscator
Free unlimitedHide your email address from spam scrapers using HTML entity, JavaScript, and reverse-string encoding.
Open toolEncrypt & Decrypt
Encrypt text with AES-256 right in your browser. Decrypt with your password.
Open toolFile Checksum Verifier
Free unlimitedVerify file integrity by comparing SHA-256 checksums.
Open toolGenerate .htpasswd Files
Free unlimitedCreate bcrypt or SHA-1 password lines for Apache and Nginx basic auth.
Open toolGenerate 2FA Codes
Free unlimitedTurn a Base32 secret into live time-based 2FA codes, right in your browser.
Open toolGenerate a JWT
Free unlimitedBuild and sign a JSON Web Token for testing — right in your browser.
Open toolHash Generator
Free unlimitedGenerate SHA-1, SHA-256, SHA-384, SHA-512 hashes for text and files.
Open toolHide Text in an Image
Hide a secret message inside a PNG image, optionally locked with an AES-256 password.
Open toolHMAC Calculator
Free unlimitedGenerate or verify HMAC signatures (SHA-1, SHA-256, SHA-384, SHA-512). Built for webhook signature debugging.
Open toolJWT Decoder
Free unlimitedDecode a JSON Web Token to inspect its header, payload, and expiry.
Open toolPassword Generator
Free unlimitedGenerate strong random passwords entirely in your browser. Length, charset, and exclude-ambiguous controls.
Open toolPassword Strength + Breach Checker
Free unlimitedLive strength meter + k-anonymity check against the Have I Been Pwned password database. Your password never leaves your device.
Open toolPassword Strength Checker
Free unlimitedRate how strong a password is and estimate its crack time — entirely in your browser, never sent anywhere.
Open toolPrivacy Report Card
Free unlimitedAudit any website's privacy posture — third-party trackers, ad and analytics scripts, HTTPS, security headers, cookie-setting code.
Open toolRedact Personal Info
Free unlimitedMask emails, phone numbers, SSNs, credit cards, and IPs in any text before you paste it into an AI or a ticket.
Open toolSPF, DKIM & DMARC Generator
Free unlimitedBuild SPF, DKIM, and DMARC records with guided forms and copy-ready DNS output.
Open toolSSL Certificate Checker
Free unlimitedCheck any website's SSL certificate and security headers.
Open toolBuilt for privacy, breadth, and speed.
Web Crypto API everywhere
Hash, HMAC, AES, key derivation — all use the browser's native crypto.subtle, which is hardware-accelerated, FIPS-validated on most platforms, and impossible to backdoor without subverting the browser itself.
k-anonymous breach checking
Breach Checker uses Have-I-Been-Pwned's k-anonymity API: only the first 5 characters of your password's SHA-1 hash leave your browser. The full password and its full hash never transmit.
Webhook signature debugging
HMAC Calculator has a dedicated Verify mode for Stripe / GitHub / Twilio / Slack webhook debugging. Paste payload, secret, and the received signature — get an immediate ✓match or ✗no-match with constant-time comparison.
No telemetry on cryptographic input
Tools in this category never log inputs. Click counts only. The password you generate, the text you encrypt, the JWT you decode — those stay on your device.
People ask these things.
How do I check if my password has been breached?
Use the Breach Checker. It hashes your password locally with SHA-1, sends only the first 5 hex characters to the Have-I-Been-Pwned API, and compares the returned suffix list locally. Your full password (and its full hash) never transmit.
Can I encrypt text in my browser?
Yes — Encryption Tool uses AES-256-GCM with PBKDF2 (310k iterations, SHA-256). Paste your text, set a password, then copy or download the encrypted output. Same parameters that 1Password and Bitwarden use for their vaults.
How do I verify a webhook signature?
Use HMAC Calculator in Verify mode. Paste the raw payload, your endpoint secret, and the received signature header. The tool computes the expected signature locally, compares constant-time, returns match/no-match. Works for Stripe, GitHub, Twilio, Slack, Vercel, and any HMAC-SHA256 webhook.
Explore more tools.
See every tool we ship.
188 browser-based tools across PDF, image, audio, developer, business, and security categories. All free for daily use; one-time license for unlimited.