Password & Security
Password generation, analysis, hashing, and security tools
Generate random passwords, passphrases and PINs, measure their strength and entropy, and check whether a password appears in known data breaches without sending the password itself. The category also includes bcrypt, Argon2, PBKDF2 and scrypt playgrounds and TOTP/HOTP one-time code tools. For a new account password, start with the password generator, then confirm it with the strength checker.
Tools in this category: 36
Good places to start
All tools in this category
-
Password Generator
Generate strong random passwords in your browser with crypto.getRandomValues. Choose length and character sets and see the exact entropy in bits.
-
Argon2id Playground
Compute Argon2id, Argon2i or Argon2d hashes with your own memory, iterations, parallelism, salt and secret. PHC string output and verification.
-
bcrypt Playground
Hash passwords with bcrypt at cost 4–16, use your own 22-character salt, see the hash broken into version, cost, salt and hash, and verify hashes.
-
Diceware Passphrase Generator
Create diceware passphrases from the EFF large wordlist (7,776 words) using virtual dice or your own physical dice rolls. Shows dice codes and entropy.
-
Common Password Dictionary Check
Check if a password or a simple variation of it (lowercase, without trailing digits, leetspeak undone) is in a 49,000-entry common password list.
-
HOTP Generator
Generate HOTP one-time passwords for any counter from a Base32 secret, with SHA-1/256/512 and 6–8 digits. Lists upcoming codes; RFC 4226 vectors verified.
-
2FA QR Code Generator
Build an otpauth:// URI and QR code for TOTP or HOTP from issuer, account and Base32 secret. Scan it with Google Authenticator, Authy or 1Password.
-
Passphrase Strength Meter
Check a multi-word passphrase: word count, EFF wordlist matches, diceware entropy if chosen randomly, and a realistic zxcvbn score. Runs locally.
-
Password Age & Rotation Checker
Calculate how old a password is from its last change date and when it expires under a maximum-age policy, with expired and due-soon warnings.
-
Password Breach Checker
Check if a password appeared in data breaches via the Have I Been Pwned range API. Only the first 5 characters of its SHA-1 hash leave your browser.
-
Password Compare Tool
Compare two passwords: identical or not, Levenshtein distance, similarity, shared prefix/suffix and warnings like 'only the digits changed'.
-
Config File Password Encoder
Escape a password correctly for JSON, YAML, TOML, XML, Java .properties, INI, URL connection strings and SQL literals so it is read back unchanged.
-
Password Converter (Hex/Binary/Base64)
Convert a password to its UTF-8 bytes as hex, \x escapes, binary, decimal, Base64, Base64URL or percent-encoding, and decode those formats back.
-
Password Entropy Calculator
Calculate password entropy as length × log2(pool size), plus Shannon entropy and a realistic zxcvbn estimate, to see how the formulas differ.
-
.env Password Escaper
Write a password into a .env line that shell, Node.js dotenv, python-dotenv or docker --env-file read back exactly, quotes and $ included.
-
Password Expiration Reminder
Plan password expiry dates for a rotation interval and download reminders as an .ics calendar file for Google Calendar, Outlook or Apple Calendar.
-
Advanced Password Generator
Generate up to 100 passwords at once with custom symbol sets, extra or excluded characters, no-repeat mode and exact entropy. Runs in your browser.
-
Password Hashing Tool
Hash a password with Argon2id, bcrypt, scrypt or PBKDF2 using OWASP-recommended settings and a random salt, and verify passwords against stored hashes.
-
Password Mask/Unmask Tool
Mask a password for display (keep first/last characters, fixed length) or redact passwords, tokens and URL credentials in logs and config text.
-
Password Pattern Detector
See exactly which parts of a password are dictionary words, keyboard patterns, years, dates, repeats or sequences, with guesses per part. Runs locally.
-
Personal Info Pattern Detector
Check whether a password contains your name, username, email parts, birthday in common formats or phone digits, even in leetspeak or reversed.
-
Password Policy Validator
Validate a password against NIST SP 800-63B-4, OWASP ASVS, PCI DSS v4.0 or your own rules: length, character types, repeats, blocklist, username.
-
Password Policy Generator
Turn password rules into a readable policy, a validation regex, an HTML input with pattern and passwordrules, and JSON config. Presets for NIST and PCI.
-
Password Predictability Checker
Detect predictable human habits in a password, like capital first letter plus year and '!', seasons, keyboard walks and leetspeak, with hashcat mask.
-
Password Statistics Tool
Count a password's characters, UTF-8 bytes, uppercase, lowercase, digits, symbols, unique characters and runs, with Shannon and pool entropy.
-
Password Strength Checker
Check password strength with zxcvbn-ts: score 0–4, estimated guesses, crack times for four attack scenarios and concrete tips. Nothing is uploaded.
-
PBKDF2 Playground
Derive keys with PBKDF2-HMAC-SHA-1/256/512 using your salt, iterations and key length. Hex, Base64 and passlib output, RFC 6070 vectors verified.
-
Random PIN Generator
Generate random 3–12 digit PINs with a secure RNG and optionally skip weak PINs like 1234, 1111, 1212, common PINs and years. Shows exact entropy.
-
Random Word Generator
Pick random English words from the 7,776-word EFF list, filtered by length and first letters, without duplicates. Copy or download the word list.
-
Scrypt Playground
Compute scrypt with custom N, r, p, salt and key length, see the memory needed, and get raw hex or a $scrypt$ string. RFC 7914 test vectors verified.
-
Security Phrase Generator
Generate random, pronounceable phrases like '11 modern forests juggle cleverly' for security question answers and verbal passwords. Entropy shown.
-
TOTP Generator (2FA)
Generate time-based one-time passwords (TOTP) from a Base32 secret with SHA-1/256/512, 6–8 digits and any period. Live countdown, RFC 6238 verified.
-
TOTP Validator
Check whether a TOTP code is valid for a Base32 secret at the current or a given time, with an adjustable ±steps window like real 2FA servers use.
-
Username Generator
Generate random usernames like BraveOtter42 in camelCase, snake_case, kebab-case or dotted style, with optional digits and a maximum length.
-
Wordlist Analyzer
Analyze a diceware or password wordlist: unique words, duplicates, length stats, entropy per word, words needed for 60–128 bits and prefix checks.
-
XKCD Password Generator
Generate xkcd-style passphrases from random common words with your choice of separator, capitalization and word length. Entropy is shown in bits.
Other categories
- CRC Cyclic Redundancy Check algorithms for error detection
- MD Message Digest algorithms (MD2, MD4, MD5)
- SHA-1 Secure Hash Algorithm 1 - 160-bit hash function
- SHA-2 Secure Hash Algorithm 2 family (SHA-224, SHA-256, SHA-384, SHA-512)
- SHA-3 Secure Hash Algorithm 3 based on Keccak
- Keccak Keccak cryptographic hash function
- SHAKE Extendable-output functions (SHAKE128, SHAKE256)
- cSHAKE Customizable SHAKE functions
- KMAC Keccak Message Authentication Code
- Encryption & Cryptography Symmetric and asymmetric encryption, HMAC and key generation (AES, 3DES, RSA, PGP)
- Encoding Encode and decode data: Base64, Base32, Base58, URL, HTML entities, hex, Unicode and more
- Formatters Format, minify and validate code and data (JSON, XML, YAML, SQL, HTML, CSS) and convert naming cases
- Generators Generate IDs, keys, test data, QR codes, barcodes and config files (UUID, API keys, .gitignore, Dockerfile)
- Converters Convert data formats, number bases, colours, timestamps, units and currencies (JSON, CSV, YAML, XML)
- Text Tools Count, compare, clean and transform text (word count, diff, regex, case, duplicates)
- Image Tools Tools for manipulating and converting images (Compress, Resize, Convert)
- Design & CSS Generate CSS visually: shadows, gradients, flexbox and grid layouts, animations and colour palettes
- Web Tools Tools for web developers and SEO (JWT, URLs, DNS, HTTP headers, meta tags, sitemaps)
- Math & Calculators Calculators for finance, health, percentages, programmer arithmetic and everyday maths
- Time & Date Time zones, date differences, business days, timers, stopwatch and world clock