Security & Privacy

Gives you a throwaway inbox that receives mail for a limited time, with attachments viewable in place.

Generates random passwords with length, character set and ambiguous-character rules, in bulk if needed.

Inspects a link’s shape before you open it — lookalike characters, IP-literal hosts, @ tricks, deep subdomains, odd ports, shorteners — and on request traces its redirects and looks up the domain’s registration date. No reputation database.

Opens a zip without extracting it and flags path traversal entries, executables, macros and zip bombs.

Decodes a Google Authenticator migration QR into the individual accounts and their secrets.

Checks whether a password appears in Have I Been Pwned’s breach data, sending only the first five characters of its SHA-1 hash from the browser (k-anonymity).

Sends the preflight a browser would send from a chosen origin plus a GET with that Origin, and explains by the Fetch standard’s rules exactly which header blocked it.

Encrypts any file with AES-256-GCM from a passphrase, and decrypts files it produced.

Builds an email from blocks as table-based, inline-styled HTML with a VML-backed button, and writes the plain-text alternative from the same blocks.

Checks an email’s HTML against what each mail client actually supports, points at the element that breaks, and shows what survives Gmail, Outlook and the rest side by side.

Removes author, device, GPS and revision metadata from documents, images, audio and video in one pass.

Builds a diceware-style passphrase from a word list, showing the entropy in bits.

Estimates how long a password would take to crack, naming the patterns that weaken it.

Generates cryptographic random bytes as hex, Base64 or Base64URL at a chosen length, for app secrets.

Scans pasted code, logs or a config dump for API keys, tokens and private keys, with entropy heuristics.

Grades a site’s HSTS, CSP, frame, referrer and permissions headers and shows what to add.

Encrypts a note in the browser and gives you a one-time link that destroys the note after it is read.

Turns a TOTP secret into the current six-digit code with a countdown, for testing 2FA setups.

Creates Apache or nginx basic-auth entries with bcrypt, APR1 or SHA hashing.

Builds a Content-Security-Policy from a guided form or from a report, and explains each directive.

What Gmail, Outlook, Apple Mail, Yahoo, Samsung Mail and Thunderbird support in HTML email, from caniemail’s device tests, with the date each was last tested.

Measures the Shannon entropy of a string or file and shows a byte histogram — useful for spotting keys.

Guesses which algorithm produced a hash from its length, charset and prefix, ranked by likelihood.

Opens PKCS#12, JKS or PEM bundles and lists the certificates, chains and key algorithms inside.

Extracts VBA projects from .docm/.xlsm/.pptm and legacy .doc/.xls, shows each module’s source with auto-run procedures and risky calls highlighted, and lists external links, DDE fields and Excel 4.0 macro sheets.

Builds an otpauth:// URI from issuer, account and secret and renders the QR an authenticator app can scan.

Converts a password-manager CSV export between 1Password, Bitwarden, Chrome/Edge, KeePass, KeePassXC and LastPass layouts, with the column map for each documented.

Encrypts and decrypts OpenPGP messages with a passphrase, entirely in the browser — RFC 4880 symmetric mode (AES-256, SHA-256 S2K, MDC), interoperable with gpg -c. Public-key encryption and signatures are not built.

Send a draft to a disposable address from your own account and see what the sending path rewrote — links wrapped in redirects, dropped style blocks, added beacons, the encoding used.

Computes the Subresource Integrity attribute (sha256/384/512) for a script or stylesheet you paste or drop in.