Media tools are next. Everything ships the same way: it runs in your tab, or it does not ship.
Generators
Create the values you would otherwise invent badly: passwords, passphrases, PINs, UUIDs, hashes, signatures, slugs and filler text. Everything is computed by your browser's own crypto, so nothing to copy ever existed outside your tab.
20 tools. All in your browser.
Nothing you paste is uploaded, and once a tool has loaded it keeps working offline. Free, no signup.
Passwords & secrets
4 tools
A generated secret is only as trustworthy as the code that produced it, which is why these tools are the checkable kind: switch the network off and they keep working, because generation is local JavaScript against the Web Crypto API. The password generator shows entropy in bits and crack-time estimates against a throttled login and an offline GPU rig instead of a strength bar; the passphrase generator rolls Diceware words off the EFF list and can show the dice rolls for auditing; the PIN generator filters the codes attackers guess first and prices the filter honestly; the bcrypt tool hashes and checks passwords with the cost factor's real slowness measured live.
UUIDs in the two versions that matter: v4 when an ID must be unguessable, v7 when a database has to index it. The generator keeps v7 batches strictly sorted through the RFC 9562 counter, decodes the embedded timestamp under every value, and shows the batch collision odds as a number instead of a promise. Formats for the GUID and no-dash conventions included, up to a thousand at a time.
One engine, five digests. The SHA family and HMAC come from the browser's Web Crypto API, MD5 from an in-page implementation of the RFC, and every page shares the same verify field: paste the checksum you expect, a full sha256sum line included, and a mismatch names the first differing character, or tells you the paste is a different algorithm judging by its length. Files are hashed byte for byte without leaving the tab, which matters most exactly when the file is the sensitive part.
Sometimes you need a JWT that is wrong on purpose: expired five minutes ago, signed with the weak secret from the tutorial, or carrying the claim your middleware should reject. The generator signs HS256, RS256 and ES256 tokens via the Web Crypto API from any payload you type, generates key pairs on demand, and neither the secret nor the key ever leaves the tab.
Real customer data has no business in a staging database, and made-up data usually fails the first validator it meets. These generators produce data that passes: profiles with locale-consistent names, addresses and phone formats for de-DE, de-AT, en-US and en-GB, reproducible by seed so a bug report stays reproducible too; IBANs whose mod-97 check digits are correct for ten countries; and the official Stripe, Braintree and Adyen test cards next to random Luhn-valid numbers, decline scenarios included.
The unglamorous generators every project needs eventually. The slug tool turns a content plan's worth of titles into URL slugs in one paste, transliterating the characters naive slugify functions drop (ø, ł, ß) and flagging duplicates before they become duplicate URLs. The lorem ipsum generator adds the mode the others skip: an exact character count, for testing maxlength fields and truncation instead of eyeballing them. The zero width space page copies exactly one invisible character per click, U+200B through the 0xFEFF byte order mark, and its verify field lists the codepoints your clipboard really holds, because that is the one thing you cannot see.
Code generators for the translation work between a database and its client library. The Supabase generator starts from the side you already know, real SQL, and emits the supabase-js, Python or curl equivalent: joins become embeds with the right !inner modifier, OR groups become PostgREST filter strings, and a query the API cannot express comes back as a ready-to-run RPC function instead of silently wrong code.
A cron expression is five fields in an order nobody remembers and a meaning nobody reads fluently, so the generator lets you click it together instead: every, every N, specific values or a range per field, with the expression, its plain-English reading and the next five runs updating as you go. The same schedule comes out as a crontab line, a Kubernetes CronJob with timeZone, a GitHub Actions workflow, a systemd OnCalendar timer, a Spring annotation and an EventBridge expression, each copy-ready, and the findings name what a valid expression can still get wrong: the day-field OR rule, the hour the next DST jump deletes in your timezone, steps that do not divide 60.
A robots.txt is ten lines that decide what half the internet's bots do on your site, and most examples online predate the AI crawlers entirely. The generator assembles per-bot rules from presets, carries a dated blocklist of the AI training crawlers (GPTBot, ClaudeBot, CCBot and friends), and validates the result against the same RFC 9309 rules the tester applies before you copy it.
The parsers ship with the page, so a tool keeps working after you go offline.
Instant, as you type
Every tool runs the moment you type. No run button, no waiting, nothing to install.
Free forever, no signup
No account, no paywall, no trial that expires. All 110+ tools, free for everyone.
Generated locally, or not worth generating
A password generator is the one tool category where "runs in your browser" is not a convenience but the entire point. A server that generates your password has seen your password, and the same logic applies to hashing one, or signing a payload with your webhook secret: a server that has computed your HMAC has held the key. Every generator here draws on crypto.getRandomValues and crypto.subtle, the same primitives that produce TLS keys, and each page keeps working in flight mode, which is the honest way to prove it.
What is coming next
ULIDs and Nano IDs, Argon2, TOTP debugging codes, QR codes and key pairs are on the list, in that rough order. Same rule for all of them: generated in the tab, or not shipped.
Randomness, entropy and generated data
Is Math.random() good enough for a token or a password?
No. Math.random() is a fast pseudo-random generator with no security guarantee, its state can be recovered from a handful of outputs, and the spec does not even require it to be seeded unpredictably. Use crypto.getRandomValues in the browser and in Deno, crypto.randomBytes or crypto.randomUUID in Node, secrets in Python, crypto/rand in Go, java.security.SecureRandom in Java. The rule is blunt on purpose: if an attacker gains anything by predicting the value, Math.random is disqualified.
How much entropy does a secret actually need?
For anything an attacker can only guess online, against rate limiting, about 40 bits is already impractical to brute force. For a value that can be attacked offline, such as a password behind a leaked hash, aim for 80 bits or more, which is five or six Diceware words. For machine-generated tokens the convention is 128 bits, which is what a UUID v4 and a 22-character base64url string give you, and there is no reason to go below it since nobody has to type them.
Is it safe to generate a production secret in a browser tab?
It depends on one property: whether the page generates the value locally or asks a server for it. A page using crypto.getRandomValues produces the value in your process, and it is never transmitted, which is no worse than running openssl rand locally. A page that fetches the secret from an API has by definition shown it to someone else. Check by opening the network tab while generating, or by disconnecting from the network first, and treat anything that requires connectivity as compromised for this purpose.
What is the difference between a hash, an HMAC and a signature?
A hash proves that content did not change, but anyone can recompute it, so it proves nothing about who produced it. An HMAC adds a shared secret, so the recipient knows the sender held the same key; both sides can produce it, which is fine for webhooks and useless as evidence to a third party. A signature uses a private key, so only the holder can produce it and anyone with the public key can verify, which is what makes it non-repudiable and why JWTs use RS256 or ES256 when more than one party is involved.
Is generated test data safe to use under the GDPR?
Synthetic data invented by a generator is not personal data at all, so it falls outside the regulation, which is exactly why it beats a copy of production for filling a staging database. Pseudonymised production data is a different thing: recital 26 treats it as still personal, because it can be re-attributed. The practical line is whether any row descends from a real person. If it does, the environment needs the same protection as production; if it never did, it does not.