Free Online Security Tools

Passwords, tokens, charset conversion, key management — security utilities that run entirely locally, with randomness from the browser's native crypto and sensitive data that never leaves your device.

Password Generator

Bulk-generate strong random passwords with controllable length & charset

Open tool →

Password Strength Checker

Entropy estimate plus common-password penalties, rating & crack-time estimate

Open tool →

Token Generator

Bulk-generate Hex / Base62 / UUID v4 tokens with unbiased randomness

Open tool →

Charset Converter

Convert text to/from UTF-8 hex, percent-encoding, HTML entities & \u escapes

Open tool →

API Key Manager

Local key vault with masked display, JSON import & export

Open tool →

Why these security tools?

Cryptographic randomness

Passwords and tokens come from the browser's native Web Crypto API (crypto.getRandomValues), with rejection sampling so every character is picked with exactly equal probability.

Local by design

Strength checking, charset conversion and key management all happen in your browser; API keys live only in this device's localStorage and never touch a server.

Transparent rules

Entropy math, penalty rules and rating thresholds are documented on the page, so results are reproducible and easy to cross-check.

Frequently asked questions

Are these passwords and tokens actually safe?

Randomness comes from OS-level cryptographically secure random (Web Crypto), not ordinary Math.random; generation is offline and results are never logged. Save them into a password manager right away.

Are my passwords or API keys uploaded?

No. Strength checking, charset conversion and key management run as local JavaScript; API keys live only in the current browser's localStorage and the page issues no data requests.

How is password strength scored?

Entropy is first estimated from the character classes actually used (length × log2(charset size)), then penalties apply — common-password hit (−40), digits-only, sequential runs, repeated characters, or length under 8 (each −10) — before mapping to weak / fair / strong / very strong.

Everything is generated and stored locally in your browser — passwords and tokens are never sent to a server.