Media tools are next. Everything ships the same way: it runs in your tab, or it does not ship.
Generators
Create the values you would otherwise invent badly: passwords, passphrases, PINs, UUIDs, hashes, signatures, slugs and filler text. Everything is computed by your browser's own crypto, so nothing to copy ever existed outside your tab.
13 tools. All in your browser.
Nothing you paste is uploaded, and once a tool has loaded it keeps working offline. Free, no signup.
Passwords & secrets
4 tools
A generated secret is only as trustworthy as the code that produced it, which is why these tools are the checkable kind: switch the network off and they keep working, because generation is local JavaScript against the Web Crypto API. The password generator shows entropy in bits and crack-time estimates against a throttled login and an offline GPU rig instead of a strength bar; the passphrase generator rolls Diceware words off the EFF list and can show the dice rolls for auditing; the PIN generator filters the codes attackers guess first and prices the filter honestly; the bcrypt tool hashes and checks passwords with the cost factor's real slowness measured live.
UUIDs in the two versions that matter: v4 when an ID must be unguessable, v7 when a database has to index it. The generator keeps v7 batches strictly sorted through the RFC 9562 counter, decodes the embedded timestamp under every value, and shows the batch collision odds as a number instead of a promise. Formats for the GUID and no-dash conventions included, up to a thousand at a time.
One engine, five digests. The SHA family and HMAC come from the browser's Web Crypto API, MD5 from an in-page implementation of the RFC, and every page shares the same verify field: paste the checksum you expect, a full sha256sum line included, and a mismatch names the first differing character, or tells you the paste is a different algorithm judging by its length. Files are hashed byte for byte without leaving the tab, which matters most exactly when the file is the sensitive part.
The unglamorous generators every project needs eventually. The slug tool turns a content plan's worth of titles into URL slugs in one paste, transliterating the characters naive slugify functions drop (ø, ł, ß) and flagging duplicates before they become duplicate URLs. The lorem ipsum generator adds the mode the others skip: an exact character count, for testing maxlength fields and truncation instead of eyeballing them.
Code generators for the translation work between a database and its client library. The Supabase generator starts from the side you already know, real SQL, and emits the supabase-js, Python or curl equivalent: joins become embeds with the right !inner modifier, OR groups become PostgREST filter strings, and a query the API cannot express comes back as a ready-to-run RPC function instead of silently wrong code.
The parsers ship with the page, so a tool keeps working after you go offline.
Instant, as you type
Every tool runs the moment you type. No run button, no waiting, nothing to install.
Free forever, no signup
No account, no paywall, no trial that expires. All 70+ tools, free for everyone.
Generated locally, or not worth generating
A password generator is the one tool category where "runs in your browser" is not a convenience but the entire point. A server that generates your password has seen your password, and the same logic applies to hashing one, or signing a payload with your webhook secret: a server that has computed your HMAC has held the key. Every generator here draws on crypto.getRandomValues and crypto.subtle, the same primitives that produce TLS keys, and each page keeps working in flight mode, which is the honest way to prove it.
What is coming next
ULIDs and Nano IDs, Argon2, TOTP debugging codes, QR codes and key pairs are on the list, in that rough order. Same rule for all of them: generated in the tab, or not shipped.
Randomness, entropy and generated data
Is Math.random() good enough for a token or a password?
No. Math.random() is a fast pseudo-random generator with no security guarantee, its state can be recovered from a handful of outputs, and the spec does not even require it to be seeded unpredictably. Use crypto.getRandomValues in the browser and in Deno, crypto.randomBytes or crypto.randomUUID in Node, secrets in Python, crypto/rand in Go, java.security.SecureRandom in Java. The rule is blunt on purpose: if an attacker gains anything by predicting the value, Math.random is disqualified.
How much entropy does a secret actually need?
For anything an attacker can only guess online, against rate limiting, about 40 bits is already impractical to brute force. For a value that can be attacked offline, such as a password behind a leaked hash, aim for 80 bits or more, which is five or six Diceware words. For machine-generated tokens the convention is 128 bits, which is what a UUID v4 and a 22-character base64url string give you, and there is no reason to go below it since nobody has to type them.
Is it safe to generate a production secret in a browser tab?
It depends on one property: whether the page generates the value locally or asks a server for it. A page using crypto.getRandomValues produces the value in your process, and it is never transmitted, which is no worse than running openssl rand locally. A page that fetches the secret from an API has by definition shown it to someone else. Check by opening the network tab while generating, or by disconnecting from the network first, and treat anything that requires connectivity as compromised for this purpose.
What is the difference between a hash, an HMAC and a signature?
A hash proves that content did not change, but anyone can recompute it, so it proves nothing about who produced it. An HMAC adds a shared secret, so the recipient knows the sender held the same key; both sides can produce it, which is fine for webhooks and useless as evidence to a third party. A signature uses a private key, so only the holder can produce it and anyone with the public key can verify, which is what makes it non-repudiable and why JWTs use RS256 or ES256 when more than one party is involved.
Is generated test data safe to use under the GDPR?
Synthetic data invented by a generator is not personal data at all, so it falls outside the regulation, which is exactly why it beats a copy of production for filling a staging database. Pseudonymised production data is a different thing: recital 26 treats it as still personal, because it can be re-attributed. The practical line is whether any row descends from a real person. If it does, the environment needs the same protection as production; if it never did, it does not.