Tools
Hash and verify files, generate passphrases, test password strength, and play with ciphers. Everything runs in your browser.
Every tool here runs in your browser, and nothing you type or drop on one is sent anywhere. The pages make no network requests while you use them, the Content-Security-Policy would stop them if they tried, and our tests check it. We check each tool against the official published test vectors, and each links to the article that explains how it works.
Hashing and verification
Check a download, hash a file, compare two digests, or find out what kind of hash you are holding.
- Hash generatorHash text or a file of any size with MD5, SHA-2, SHA-3, BLAKE2 or BLAKE3. Nothing leaves your browser.
- SHA-256 hash generatorGet the SHA-256 of text or a file in your browser. Known values to check against, commands for every system, and a note on how strong it is.
- File checksum checkerDrop a file, paste the checksum from the download page, get a tick or a cross. Or paste a whole SHA256SUMS file and drop many files.
- MD5 hash generatorGet the MD5 of text or a file in your browser, plus how MD5 was broken and what it is still good for.
- Compare two hashesPaste two checksums and see whether they match, even if one is uppercase, has colons in it, or is Base64 instead of hex.
- SHA-1 hash generatorGet the SHA-1 of text or a file in your browser, with the SHAttered story, known values, and what to use instead.
- Hash identifierPaste a hash and see which algorithm or password format it looks like, going by its prefix, length and alphabet.
- SHA-512 hash generatorGet the SHA-512 of text or a file in your browser, with the SHA-2 family side by side, known values and commands for every system.
- HMAC generator and checkerCompute or verify an HMAC with a text, hex or Base64 key. Checked against the RFC 4231 and RFC 2202 test vectors.
- SHA-3 hash generatorGet the SHA3-256 of text or a file in your browser, and see how the Keccak sponge differs from SHA-2 and from Ethereum's keccak256.
- SHA-256 visualizer and explorerType any text and step through the padding, the message schedule and all 64 rounds of SHA-256, then flip one input bit to see the avalanche.
- Checksum calculatorCompute CRC-32, CRC-32C, CRC-16, CRC-8, Adler-32 and Fletcher, read the bit-by-bit definition, and forge a CRC to see why it is not security.
Passwords, passphrases and randomness
Make strong secrets, measure them honestly, and see how much work guessing one takes.
- Passphrase generatorRandom words from the EFF lists or ours, with the entropy worked out exactly and no bias in the draw.
- Random password generatorUnbiased random passwords with the entropy counted exactly, including what a "must contain a symbol" rule costs you.
- Password strength checkerType a password and see how long a GPU would need to guess it if it were stored as MD5, bcrypt or PBKDF2. The speeds are measured and the assumptions are stated.
- PBKDF2 benchmarkRuns the real PBKDF2-SHA256 on your device at 1,000 to 600,000 iterations and shows what each password guess costs.
- Random number generator for bytes, UUIDs and diceSecure random bytes, UUIDs, unbiased integers and dice, plus a live demo of the modulo-bias bug.
- PBKDF2 calculatorPassword, salt, iterations, hash and length in, key out. Loads the RFC 6070 and 7914 test vectors so you can check it.
- TOTP code generatorTurn a Base32 secret into the six-digit code your authenticator shows, see each of the steps, and check a code with the usual one-step tolerance.
Encoding
Base64, hex and the other ways bytes become text.
- Base64 encoder and decoderEncode text or any file to Base64 and decode it back, standard or URL-safe, with padding and line options, data URIs and downloads.
- XOR calculator and repeating-key breakerXOR text, hex or Base64 with a key, then watch a repeating-key XOR fall to frequency analysis.
- Hex converterConvert between text, hex, binary and decimal bytes as you type, UTF-8 aware, with separators and 0x or escape styles. Edit any box.
- URL encoder and decoderPercent-encode and decode text and URLs as a component, a whole URL or a form value, and take any URL apart into its pieces.
- Base32 decoder and encoderEncode and decode Base32 in the RFC 4648, base32hex and Crockford alphabets, and read the Base32 secret behind a TOTP code.
- JWT decoderDecode a JSON Web Token: header, payload, claims as plain dates, and warnings for alg none and key-injection headers. It never verifies and never asks for a secret.
- PEM and certificate decoderRead a PEM certificate, CSR or public key: names, validity, key type and size, extensions, fingerprints and a host-name check. It refuses private keys.
- Unicode inspectorSee every code point of a text with its UTF-8 and UTF-16 forms, and find invisible, bidirectional and look-alike characters.
Encryption playgrounds
Run and take apart the ciphers that protect real data today.
- AES round explorerStep through SubBytes, ShiftRows, MixColumns and AddRoundKey on any block and watch the avalanche build.
- AES playgroundEncrypt and decrypt with AES-GCM, CBC and CTR, see the tag, flip one bit, and watch a reused nonce give a message away.
- The ECB penguin demoEncrypt a picture with AES in ECB and in CBC mode side by side, and see why nobody should use ECB.
Classical ciphers
Caesar to Enigma: encode, decode and break them.
- Caesar cipher decoder and encoderPaste a ciphertext and see all 26 shifts ranked by how much they look like English. Or shift text by any amount.
- Vigenère cipher decoder, encoder and breakerEncrypt and decrypt with a key, or paste a ciphertext and let the tool find the key length and then the key.
- Substitution cipher solverPaste a ciphertext and let hill climbing recover the key, or assign letters yourself with live counts.
- Frequency analysis toolCount the letters in a text, compare them with English, and see which kind of cipher the numbers point to.
- Enigma machine simulatorA working Enigma I, M3 and M4. Set the rotors, rings and plugboard, type, and watch the lamps. Tested against the Dönitz message of 1945.
- Morse code translatorText to Morse and back, played as tones with the standard timing, adjustable speed and spacing, an optional light, and the full table.
Maths and primes
The number theory behind public-key cryptography, made interactive.
- Discrete logarithm calculatorFind x where g^x = h mod p by baby-step giant-step, then see why the same problem is hopeless at 2,048 bits.
- RSA calculatorGenerate a toy RSA key, encrypt and decrypt numbers or text with exact big-integer maths, then break it by factoring the modulus.
- Diffie-Hellman calculatorPick secrets, swap public values and see both sides land on the same key, in a tiny group or the 2,048-bit RFC 3526 group.
- Shamir secret sharingSplit a secret into n shares so that any k recover it and fewer reveal nothing. The GF(256) maths is worked by hand.
- Prime factorization calculatorBreak a number into primes with Pollard's rho, and see a factor tree, its divisors, Euler's phi and where the tool gives up.
- GCD calculatorEuclid's algorithm with every division shown, plus Bezout's identity, the least common multiple and the modular inverse, for numbers of any size.
- Modular exponentiation calculatorCompute b^e mod n with square-and-multiply shown bit by bit, for numbers up to 400 digits, and see why RSA depends on it.