Every tool
64 instruments across seven channels. All of them run in your browser. Press ⌘K to jump straight to one.
- Random API key generatorDraw 64 to 1024 bits of key material from your browser's CSPRNG, in any encoding.
- Custom prefix key builderBuild keys with a vendor-style prefix so scanners, logs and engineers can identify them instantly.
- High-entropy secret generatorGenerate signing keys, session secrets and encryption keys at 128 to 1024 bits.
- Hex & Base64 token generatorGenerate tokens at an exact character length in the alphabet your system requires.
- Bulk key generator & CSV exportGenerate up to 1,000 keys with metadata and export as CSV, JSON, SQL or plain text.
- Webhook signing secret generatorGenerate the shared secret your endpoint uses to verify inbound webhook signatures.
- UUID, ULID & Nano ID generatorGenerate UUID v1, v4 and v7, ULIDs, Nano IDs and Base58 identifiers.
- Provider key format generatorProduce format-accurate fake keys for OpenAI, Stripe, AWS, GitHub and others — for testing detectors.
- Pronounceable token generatorGenerate tokens made of words or syllables, with an honest entropy count.
- One-time password & PIN generatorGenerate OTP codes and PINs, with the attempt-limiting requirements stated plainly.
- API key vendor detectorIdentify which provider a key belongs to, what it grants, and how to revoke it.
- Staging vs production discriminatorTell test credentials from live ones before you send a request with the wrong one.
- Hardcoded secret linterLint a .env file or source snippet for hardcoded credentials, weak values and unsafe patterns.
- Secret leak scannerScan a diff, file or log for leaked credentials across 90+ provider signatures.
- Entropy & brute-force calculatorMeasure a secret's real search space and see how long it survives at five attack rates.
- Credential regex testerTest detection patterns against real text, or load a signature from the built-in library.
- Blast radius analyzerScore what one leaked credential would actually cost you, and what to do about it.
- Encrypted secret link generatorSplit a secret into a ciphertext link and a separate key, so neither channel alone reveals it.
- Secret masker & redactorRedact a credential so it can appear in a ticket, log or screenshot without being usable.
- Key revocation command generatorGet the exact revocation commands, verification step and incident checklist for your provider.
- JWT decoder & debuggerDecode header, payload and signature, resolve every timestamp, and verify with a secret or public key.
- JWT expiry & TTL calculatorCompute exp, iat and nbf correctly, and see the exposure window each lifetime creates.
- OAuth access & refresh token generatorMint signed HS256 tokens with real claims for local testing and fixtures.
- Bearer token formatter & parserBuild a correct Authorization header, or take one apart to see what is actually being sent.
- OIDC ID token inspectorRun the seven OIDC validation checks against an ID token and see which ones fail.
- Session token & cookie inspectorDecode a session value and audit the cookie attributes that decide whether it is stealable.
- Access token scope builderSelect scopes and see exactly what each one grants before you create the token.
- SAML assertion parserDecode a SAMLResponse from either binding and read its issuer, subject, conditions and attributes.
- Token introspection & revocation builderBuild RFC 7662 introspection and RFC 7009 revocation requests with the right client authentication.
- HMAC signature generatorCompute HMAC-SHA1, SHA-256, SHA-384 and SHA-512 signatures, and verify one you were sent.
- Webhook signature verifierReproduce Stripe, GitHub, Shopify, Slack and Svix signatures, and check one you received.
- PBKDF2 key derivationDerive keys with PBKDF2 at a measured cost, and understand when Argon2id is the better answer.
- Hash & checksum calculatorCompute digests with SHA-2, SHA-3, Keccak, SHA-1 and MD5, from text, hex or Base64 input.
- Request signature validatorReproduce a canonical string, compute its HMAC, and compare against the signature you received.
- AWS SigV4 header builderBuild a complete Signature Version 4 header, with the canonical request and string to sign shown.
- Stripe & GitHub webhook sandboxGenerate a signed event, replay it against your endpoint, and prove your rejection path works.
- Key derivation sandboxDerive independent keys from one master secret, and feel what the cost parameter actually costs.
- Hash & secret comparatorCompare two values or their digests in constant time, and find where they diverge.
- AES secret encryptorEncrypt and decrypt secrets with authenticated AES, keyed by a passphrase or raw key.
- Base64 & Base32 encoderConvert between text, hex, Base64, Base64URL, Base32, Base58, binary and decimal, with a hex dump.
- Hex to ASCII translatorTurn hex byte sequences into readable text, and see the bytes in a dump.
- URL encoder & decoderEncode and decode URL components, and see what happens to values that carry credentials.
- RSA & EC key pair generatorGenerate RSA-2048 to 4096 or EC P-256 to P-521 key pairs, exported as PEM and JWK.
- PEM & DER format converterConvert between PEM armour and raw DER, and identify what a key or certificate actually is.
- Basic auth header encoderEncode username and password into an Authorization header — and see why that is only encoding.
- Obfuscated string deobfuscatorUnwrap layered encodings — Base64, hex, escapes, character codes, ROT13 and reversal.
- Binary, hex & radix converterConvert one value into nine bases at once, from binary through Base64.
- .env file generatorGenerate a populated .env with fresh secrets, plus the .env.example that is safe to commit.
- Kubernetes & Docker secret generatorEmit Secret, SealedSecret, ExternalSecret or Compose manifests — and know which are safe to commit.
- Secrets manager payload formatterGenerate the payload and the write, read and rotate commands for five secrets backends.
- Terraform & CloudFormation secret builderDeclare secret variables correctly — and understand why sensitive = true does not encrypt state.
- CORS configuration generatorGenerate correct CORS headers for nginx, Express or Next.js — and see the combination that cannot work.
- Key rotation & TTL plannerGet a rotation interval you can actually sustain, and the zero-downtime procedure to execute it.
- Environment variable redactorRedact a column of environment values at once, before pasting them into a ticket or a doc.
- JSON & YAML config validatorCatch the syntax errors and type surprises that break configuration, plus weak secret values.
- Gitignore rules generatorGenerate ignore rules for credential files, plus the pre-commit hook that catches what they miss.
- cURL command generatorBuild an authenticated request as cURL, fetch, httpx or HTTPie, and see the raw HTTP it produces.
- Authorization header builderBuild Bearer, Basic, ApiKey and Token headers for tests and fixtures.
- Rate limit header simulatorSee exactly what your client receives at the limit, in three header conventions.
- OpenAPI & Postman scheme generatorGenerate a correct OpenAPI 3.1 securityScheme or a Postman collection with auth configured.
- 401 & 403 error simulatorSee the exact response for each auth failure mode, and what actually causes it.
- API authentication sandboxStep a request through the checks a gateway performs and see exactly where it fails.
- Webhook payload simulatorGenerate a signed event and replay it locally, including the tampered version your endpoint must reject.
- REST & GraphQL auth header debuggerPaste your request headers and find the malformed credential in seconds.