Security tools 45
Hashes, certificate parsers, password tools and network calculators for security work. X.509, CSR and CRL parsing, JA3 and HASSH fingerprints, CIDR maths, IOC extraction and defanging. Parsers read structure and report it; none of them verify a signature or a certificate chain.
Hashes20
1→1File checksumCompute a cryptographic hash of any file, locally.Takes one filen→nMD5 hashCompute a MD5 digest of any file.Runs on each file you dropn→nSHA-1 hashCompute a SHA-1 digest of any file.Runs on each file you dropn→nSHA-256 hashCompute a SHA-256 digest of any file.Runs on each file you dropn→nSHA-384 hashCompute a SHA-384 digest of any file.Runs on each file you dropn→nSHA-512 hashCompute a SHA-512 digest of any file.Runs on each file you dropn→nSHA3-256 hashCompute a SHA3-256 digest of any file.Runs on each file you dropn→nSHA3-512 hashCompute a SHA3-512 digest of any file.Runs on each file you dropn→nKeccak-256 hashCompute a Keccak-256 digest of any file.Runs on each file you dropn→nKeccak-512 hashCompute a Keccak-512 digest of any file.Runs on each file you dropn→nBLAKE2b hashCompute a BLAKE2b digest of any file.Runs on each file you dropn→nBLAKE2s hashCompute a BLAKE2s digest of any file.Runs on each file you dropn→nBLAKE3 hashCompute a BLAKE3 digest of any file.Runs on each file you dropn→nRIPEMD-160 hashCompute a RIPEMD-160 digest of any file.Runs on each file you dropn→nSM3 hashCompute a SM3 digest of any file.Runs on each file you dropn→nWhirlpool hashCompute a Whirlpool digest of any file.Runs on each file you dropn→nCRC32 checksumCompute a CRC32 digest of any file.Runs on each file you dropn→nAdler-32 checksumCompute a Adler-32 digest of any file.Runs on each file you dropn→nxxHash3Compute a xxHash3 digest of any file.Runs on each file you dropn→nxxHash64Compute a xxHash64 digest of any file.Runs on each file you drop
Certificates & keys6
n→nX.509 certificate parserDecode a PEM or DER X.509 certificate into subject/issuer/validity/public key/extensions. Reports what the certificate says about itself. No chain building, no revocation check, no clock: it does not tell you whether to trust it.Runs on each file you dropn→nCSR parserDecode a PEM or DER PKCS#10 certificate signing request into subject, public key and requested extensions (including subjectAltName, when present in an extensionRequest attribute). Reports the request, not a decision about whether it should be signed.Runs on each file you dropn→nCRL parserDecode a PEM or DER Certificate Revocation List into issuer, update times, and each revoked serial with its revocation date/reason. Reports what the CRL states, not whether it is current, or whether a given certificate is on it if you have not checked.Runs on each file you dropn→nJWK ↔ PEMConvert an RSA or EC key between JWK (JSON) and PEM (SPKI/PKCS8), via crypto.subtle import/export. Ed25519/OKP keys are not supported. On your device.Runs on each file you dropn→nPEM ↔ HexConvert a PEM block to the raw hex of its DER payload, or wrap hex bytes back into PEM armor. On your device.Runs on each file you dropn→nPublic key from cert / private keyExtract the public key from an X.509 certificate (always available; it is right there in the cert), or from an RSA/EC private key. RSA is always derivable (n/e are part of the private key itself); EC only when the key embeds its public point (SEC1's optional field; usually present, not guaranteed). This tool does not do elliptic-curve scalar multiplication to compute a missing one.Runs on each file you drop
Passwords3
·→1Password generatorGenerate a random password from crypto.getRandomValues, drawn uniformly from the selected character classes combined (does not guarantee at least one of each class). On your device, never sent anywhere.Takes no file·→1Passphrase generatorGenerate a random passphrase from a bundled list of 264 common English words (not the EFF/Diceware list; see src/wordlist.ts). Entropy is exactly words * log2(264) bits; words drawn with crypto.getRandomValues.Takes no file·→1Password strength (offline heuristics)Reports observable properties of a password, including length, character classes, repeated/sequential/keyboard-row runs, and membership in a small bundled list of ~130 famously common passwords. This is NOT zxcvbn (that needs a dependency this build does not add) and renders no verdict: no breach corpus, no crack-time estimate, "strong"/"weak" is a guess this tool refuses to make.Takes no file
Network9
·→1Subnet / CIDR calculatorCompute network address, broadcast/last address and host count for an IPv4 or IPv6 CIDR block. Pure arithmetic on the address you give it. No lookup, no network.Takes no file·→1IP range parserParse an IPv4/IPv6 range ("start-end" or CIDR) into its address count and the minimal set of CIDR blocks that cover it exactly. Pure arithmetic, no lookup.Takes no file·→1IPv4/IPv6 format convertShow one IP address in every common representation (dotted/expanded, integer, and hex), computed locally.Takes no file·→1IPv6 transition addressesBuild IPv4-mapped/6to4/NAT64 IPv6 forms from an IPv4 address, or decode an IPv6 address back to its embedded IPv4 (and, for Teredo, server/client/port/flags). Reports what pattern was recognised, not whether the address is reachable or in use.Takes no filen→nIPv4 / TCP / UDP header parserDecode an IPv4 header, then its TCP or UDP header if the protocol field says so (checksum verified against the standard Internet checksum, not TCP/UDP's, which need a pseudo-header this tool is not given the source context to build). Give it bytes starting at the IP header, e.g. an Ethernet frame's payload.Runs on each file you dropn→nEthernet frame parserDecode an Ethernet II frame: destination/source MAC, EtherType (unwrapping one 802.1Q VLAN tag if present), and payload length. IEEE 802.3 LLC/SNAP framing is not handled, only Ethernet II.Runs on each file you dropn→nTLS record parserDecode a raw TLS record (RFC 8446 §5.1): content type, version, length, and for a ClientHello/ServerHello, the cipher suites/extensions inside. Give it bytes captured off the wire, not a PEM.Runs on each file you drop·→1MAC address formatterReformat a MAC address between colon, dash, Cisco dot-quad and bare-hex notation, and report the multicast/locally-administered bits.Takes no file·→1MAC / OUI vendor lookupLook up a MAC address's OUI against a small bundled table of 16 well-known prefixes, not the IEEE registry (2.9M+ entries, updated continuously, no offline way to bundle it here). "Not in bundled list" means exactly that, not "no vendor exists."Takes no file
Threat intel5
n→nIOC extractorPull URLs, IPs, domains, emails, hashes, MAC addresses, file paths and dates out of text in one pass. Regex-based pattern matching, not a validator: a matched hash might be any 64 hex characters, not necessarily a real SHA-256 of anything, and "domain" filters out a small blocklist of common file extensions (.php/.exe/.sh/...) rather than knowing real TLDs. Categories can overlap by design (a domain inside a matched URL is listed under both).Runs on each file you dropn→nDefang / Fang URLDefang / Fang URL. Defang turns a live indicator into inert text (won't render as a link); fang reverses it. Pure text substitution.Runs on each file you dropn→nDefang / Fang IPDefang / Fang IP. Defang turns a live indicator into inert text (won't render as a link); fang reverses it. Pure text substitution.Runs on each file you dropn→nJA3 / JA3S fingerprintCompute the JA3 (ClientHello) or JA3S (ServerHello) TLS fingerprint from a raw captured TLS record. JA4 is not implemented. See the tool source for why. A matching fingerprint means two handshakes look alike, not that either endpoint is safe or malicious.Runs on each file you dropn→nHASSH fingerprint (SSH)Compute the HASSH fingerprint from a raw SSH KEXINIT packet. Best-effort recollection of the published field composition (kex;encryption_c2s;mac_c2s;compression_c2s, MD5), NOT checked against the reference hassh tool's output (no network access to verify). The KEXINIT wire parsing itself is plain RFC 4253. A matching fingerprint means two handshakes announced the same algorithms, nothing about trust.Runs on each file you drop
Privacy2
n→nUniversal metadata scrubberStrip metadata from a PDF, image (jpg/png/webp), or Office document (docx/xlsx/pptx). Dispatches to the engine each format already has (pdf-lib, jsquash re-encode, a new OOXML docProps stripper covering all three docProps parts, custom properties included, plus Word tracked-change and comment author names). It does not touch the document's own body text, or comment authorship inside xlsx/pptx parts; the output line names exactly what was and was not scrubbed. Video files are refused, not silently passed through: this tool does not have a verified metadata-strip path for them.Runs on each file you dropn→nPrivacy risk scannerScan a PDF for unapplied /Redact annotations (marked but not removed: a real black rectangle drawn in a page's own content stream with no annotation at all is not detected) and hidden optional-content layers, or a .docx for tracked changes, hidden text runs, and the author names and user ids left in word/*.xml (word/people.xml included, where Word keeps a comment author's name and e-mail address). Reports what was found, not a verdict. "Clean" here means these specific checks found nothing, not that the file is safe to share. Cropped-but-embedded image data is explicitly not checked (see the tool source for why).Runs on each file you drop
Questions
Do the certificate parsers verify anything?
No. X.509, CSR and CRL parsing read the structure and report the fields, dates and extensions they find. No signature is checked and no chain is built. Treat the output as a readable view of the file, not as validation.
Which hash should I use?
SHA-256 for general integrity, BLAKE3 when speed matters, and Argon2 for passwords. MD5 and SHA-1 are here for matching legacy checksums and for protocol work such as JA3, not for anything an attacker might influence.
Are CRC32 and xxHash secure?
No. They are checksums for catching accidental corruption, and they are trivial to collide on purpose. Use them for storage and transport error detection. Use SHA-256 when the input might be hostile.
Can I paste a certificate or a capture from work?
Yes. Nothing is uploaded, so the material stays on your machine, which is often the reason these tools exist rather than the online alternatives. Check your own policy, but no request carries the data anywhere.
Does the password generator produce good passwords?
It uses crypto.getRandomValues, not Math.random, and the passphrase tool prints the entropy in bits for the settings you chose so you can judge the strength rather than trust an adjective.