Free Security Tools

Which one do you actually need?

These divide into making a secret, checking one, and proving a file is what it claims to be. The password generator draws from the browser's cryptographic random source rather than JavaScript's ordinary one, which is the difference between unpredictable and merely unguessable-looking. The strength checker estimates how long a guessing attack would take against what you typed.

Hashing text and hashing a file do the same operation on different inputs, and the file version is the one with an everyday use: comparing a checksum against the one published next to a download. Encrypting text produces something that can be decrypted again with the passphrase, which hashing cannot. The TOTP generator produces the same six-digit codes an authenticator app does, from the same shared secret and the current time.

What this category will not do for you

Running in the browser is a genuine advantage here, because a password that was generated on a server was known to that server. It is also a limit. These tools do not store anything, so nothing syncs between your devices and nothing is recoverable if you close the tab. For passwords you actually use, a password manager is the right tool and this generator is a reasonable source to paste into it.

A strength estimate is also an estimate. It measures resistance to guessing, and it cannot know whether the password has already appeared in a breach, which is the way most accounts are actually lost.

Frequently asked questions

Is a password generated in my browser actually safe to use?

Yes, provided it uses the browser’s cryptographic random source, which this one does. Nothing is transmitted, so the only machine that ever saw the password is yours. That is a stronger position than a server-side generator, where the password existed on someone else’s computer before it reached you.

What is the difference between hashing and encrypting?

Encryption is reversible with the key, and it exists so that someone can read the content again later. Hashing is one way: it produces a fixed-length fingerprint that cannot be turned back into the input. Hashes are for verifying that something has not changed; encryption is for keeping something readable only to the right person.

Does a matching checksum prove a download is genuine?

It proves the file arrived intact, which rules out corruption. It proves authenticity only when the checksum reached you by a different route than the file did. A hash published on the same page as the download is worth little against an attacker who controls that page, since they could change both.