Text encryption AES-256-GCM

Type a message, pick a password, and you get a block of text you can send anywhere. Without the password nobody's reading it. The password is stretched with PBKDF2 (250,000 rounds) before it ever touches AES.

A sealed link carries the encrypted message after the #. Browsers never send that part to a server. Send the password some other way. And if you forget it, the message is gone. There is no "reset".

File vault AES-256-GCM

Lock any file with a password. You get back a .anon file that's useless without it. Drop a .anon file in here and it gets unlocked instead. Even the original file name is hidden inside the encryption.

Secret splitter Shamir · GF(256)

Split something important (a wallet seed, a master password) into several pieces. You decide how many pieces it takes to get it back. Hold fewer than that and the pieces tell you nothing at all, not even a single letter.

2FA codes TOTP · RFC 6238

Paste the secret key (or the whole otpauth:// link) from a 2FA setup screen and you get the same six digits your authenticator app shows. Good as a backup, or for testing your own login flow.

Digital signatures ECDSA P-256

Prove a message really came from you and wasn't touched on the way. Make a key pair once, keep the private key, hand the public key to people. Anyone with the public key can check your signature; nobody can forge one.

Memory passwords PBKDF2 · 300,000 rounds

One master password in your head, a different strong password for every site, and nothing saved anywhere. The same inputs always give the same password, so you can rebuild it on any computer. Bump the version when a site makes you change it.

Encrypt for someone ECDH P-256 · AES-GCM

No shared password needed. They make a key pair here and send you the public half; you lock a message with it, and only their private key opens it. Once it's sent, not even you can read it again.

QR codes

Turn a sealed link, a key or any text into a QR code and carry it from one screen to another with no network in between. The code is drawn right here, square by square.

Read one

Locked notes AES-256 · stays in this browser

A small notebook that lives only in this browser, encrypted with your password before anything gets written down. It locks itself after five quiet minutes. Lose the password and the notes are gone; nobody can get them back, me included.

Photo cleaner EXIF / GPS

Photos from a phone usually carry where you were, what phone you have and when you took them. This reads what's hidden inside and hands you a clean copy.

Hide in image LSB steganography

Tucks a message into the pixels of a picture. It looks exactly the same to the eye, but this page can pull the text back out. Add a password and even someone who knows the trick gets gibberish. Share the PNG it gives you as a file: saving it as JPG or sending it as a photo on WhatsApp wipes the message.

Ghost ink zero-width

Hides a secret inside ordinary text using characters nobody can see. Post it anywhere; everyone else just reads a normal sentence. Paste it back here to read what's underneath.

Redactor

Paste a log, an email, a chat, anything, and it blacks out the personal bits before you share it: emails, phone numbers, IPs, card numbers (checked with Luhn so random numbers are left alone), IBANs and links.

Link cleaner

Strips the tracking junk (utm_, fbclid, gclid and about seventy more) off links before you share them, unwraps Google, Facebook and Outlook redirect links back to the real address, and flags links that are pretending to be somewhere else.

Image redactor

Cover faces, names, number plates, anything, by dragging boxes over the picture. It uses solid boxes or chunky pixels, never blur, because a light blur can sometimes be undone.

Document cleaner DOCX · XLSX · PPTX · PDF

Word, Excel, PowerPoint and PDF files remember who wrote them, the company, how many minutes you spent on them, who left which comment and when they were last printed. This shows you all of it and saves a copy without it. PDFs are cleaned in place, byte for byte, so they open exactly like before.

Style scrubber

Everybody types with little habits: curly quotes, two spaces after a full stop, "sooo", a tatweel here and there. Stack enough of them and an anonymous post points straight back at you. This flattens them out and tells you which ones you've got.

Your fingerprint

Every site you visit can read all of this without asking. Put together, it's often enough to recognise your browser again, even with cookies switched off. Nothing here gets sent anywhere. It's just a mirror.

Passwords

Make a new one, or see how your current one holds up. The randomness comes from crypto.getRandomValues, not Math.random.

Hashes MD5 · SHA-1 · SHA-256 · SHA-384 · SHA-512

For text or for a file. Useful to make sure the thing you downloaded is the same thing they published, and that nobody messed with it on the way.

File X-ray magic bytes · entropy · strings

Tells you what a file really is by reading its first bytes, not by trusting its name. An "invoice.pdf" that's actually a Windows program gets called out. It also measures entropy (how random the data looks) and pulls out any readable text buried inside.

First bytes

Readable strings

Hidden characters homoglyphs · bidi · zero-width

Catches the things you can't see: invisible characters, right-to-left tricks that flip file names around, and look-alike letters such as a Cyrillic "а" sitting inside a fake paypal.com. Paste a link or a message you're not sure about.

JWT

Paste a token and see what's inside it and when it expires. The signature isn't verified, since we don't have the key.

Hash identifier

Paste a hash from a database dump, a config file or a CTF. It tells you what it most likely is, whether it's the slow kind that actually protects passwords or the fast kind that doesn't, and checks it against the passwords everyone uses.

Security headers HTTP

Paste a site's response headers (DevTools, Network tab, click the page, Response Headers; or curl -I) and get a grade, with what's missing and why it matters.

Magic decoder

Got a blob of gibberish? Paste it. It keeps peeling off layers (Base64, hex, URL encoding, gzip, HTML entities, \u escapes, char codes, JWT) until something readable comes out, and shows each step it took.

Email headers SPF · DKIM · DMARC

Got an email from "your bank"? Open the original (Gmail: the three dots, then Show original; Outlook: File, Properties) and paste it here. You'll see who really sent it, which servers it went through, and whether the domain vouches for it.

The route it took

Certificates X.509

Paste a certificate (the -----BEGIN CERTIFICATE----- block) or drop a .crt, .cer or .der file. You get who it was issued to, who vouches for it, when it dies, which names it covers, and its fingerprints.

Converters

Base64, URLs, hex, binary, HTML entities, ROT13 and friends, all in one place.

JSON

Pretty-print, minify, sort keys. If something's broken it tells you exactly where.

Regex

Try a pattern against some text and watch the matches and groups update as you type.

Diff

Line by line. Red got removed, green got added.

Number bases

Decimal, hex, binary, octal. Handles very big numbers without breaking a sweat.

Odds & ends

Little things you end up needing every other day.

Subnet calculator IPv4 · CIDR

Type an address with a prefix or a mask and get the network, broadcast, host range and how many machines fit.

chmod calculator

Tick the boxes, or type 755 or rwxr-xr-x. The other two catch up on their own.

CSP builder

Start from a preset, adjust the sources, then copy the header for nginx, Apache or a meta tag. It warns you about the usual mistakes, and "Grade it" sends the result straight to the header checker.

Image squeezer WEBP · JPG · PNG

Shrink a photo for the web or for a chat. Pick a max width and a quality and watch the size drop. The metadata goes out the window as a bonus.

JSON · CSV · YAML

Paste data in one format, get it back in another. Handles the everyday stuff: a spreadsheet saved as CSV, a config file, an API response. YAML's darker corners (anchors, tags) aren't covered.