Image Watermarker - Online Add Text or Logo to Photos
Protect your images by adding a text or image watermark. Adjust transparency, position, and rotation. All image processing is done locally; no upload to server.
UD5 Toolkit
Protect your images by adding a text or image watermark. Adjust transparency, position, and rotation. All image processing is done locally; no upload to server.
Encrypt and decrypt messages using the classic Caesar cipher with configurable shift key. Fun for puzzles and basic cryptography lessons. Entirely browser-based.
Generate ultra-secure, random passwords with configurable length and character sets. Created entirely on your device; never transmitted or stored.
Obfuscate strings using simple techniques to prevent casual reading. Useful for hiding spoilers or email addresses from bots. Decode with the same tool.
Check if a password appears in the Have I Been Pwned database using k‑Anonymity. Only the first 5 characters of the hash are sent.
Generate cryptographic and checksum hashes for any text string. Supports MD5, SHA-1, SHA-256, and CRC32. All hashing runs locally for maximum privacy.
Paste raw email headers and get a human-readable breakdown of the delivery route, authentication results, and delays. Private analysis.
Paste email headers or body text to quickly spot phishing signs, suspicious domains, and obfuscated links. Educational and private.
Create secure passwords that look like gibberish words but are easy to pronounce and remember. Mix of syllables. Local generation.
Generate a hash showing how trackers can fingerprint your browser (canvas, WebGL, fonts). Educational and privacy‑aware.
Inspect any website's SSL/TLS certificate details: issuer, expiry date, subject, and SANs. Verify certificate chains. All checks are private and require no server upload.
Easily apply ROT13 cipher to obfuscate or reveal text. A classic letter substitution cipher that works bidirectionally. Purely client-side processing.
Create a random long password that alternates consonants and vowels to mimic a pronounceable word. XKCD meets CVCV. Local.
Evaluate password strength through a short interactive story where each character set adds lines to a narrative. Educational fun.
Hide your email address from scrapers by encoding it using HTML entities and CSS tricks. Still clickable for real users. Local generator.
Look at HTTP headers and JavaScript objects to guess which browser extensions might be installed. For awareness.
Generate a standard otpauth:// URI and QR code for authenticator apps. Set issuer, account, and secret. All local.
Decode the header and payload of a JSON Web Token (JWT) without verifying the signature. Inspect claims securely on the client side. Great for developers.
Extract and view EXIF data from photos including camera settings, GPS location, and timestamps. All metadata read locally, your photos stay private.
Generate Time‑based One‑Time Passwords locally by entering a base32 secret. Verify your authenticator setup without a phone.
Compare your password against a built‑in list of the 10,000 most common passwords. Instant warning if it appears.
Strip dangerous HTML tags and attributes (scripts, onclick) to prevent XSS attacks. Safe iframe preview. Local sanitation engine.
Check if your site is cross‑origin isolated by examining the COOP and COEP headers. See if SharedArrayBuffer is available.
Build an iframe with different sandbox flags and see live which features are blocked. For secure embedding.
Create a strong, memorable password using 4 random common words. The famous xkcd method. Local wordlist.
Generate encrypted passwords for .htaccess basic authentication. Create .htpasswd entries using bcrypt, MD5, or SHA. Server admin utility, local compute.
Create random strings of any length using custom character sets. Perfect for generating API tokens, salts, and unique codes. Fully client-side secure.
Generate cryptographic key pairs using the Web Crypto API. Export as JWK or raw. No server needed; pure security.
Generate a CSR and private key pair in the browser using the Web Crypto API. Download both as files. No data sent to server.
Build a valid SPF TXT record by selecting mail servers, IPv4/IPv6 ranges, and includes. Validate syntax and get ready‑to‑publish output.
Add a repeating diagonal text watermark to your images. Adjust opacity, font, and color. Protect your photos locally.
Type a password and see a bar that fills based on estimated bits of entropy. Color‑coded feedback. No storage.
Apply a classic Caesar shift cipher with any key. Encrypt or decrypt text instantly. Brute force option included.
Store passwords and notes encrypted with a master passphrase. Data lives only in your browser's localStorage. No cloud.
Create a custom cookie consent banner with text, button styles, and colors. Copy the ready‑to‑use HTML/CSS/JS snippet.
Instantly convert plain text into HTML‑safe escaped characters for secure display in web pages. Prevent cross‑site scripting. All processing local.
Evaluate the strength of your passwords with a visual meter and detailed feedback. Check for length, complexity, and breached passwords. All analysis is client-side.
Enter a router's MAC address or serial and generate the common default WPA passphrase for major ISP brands. Educational purpose only.
Create a repeating text pattern from a short string for watermarking documents or images. Download SVG pattern.
Define minimum length, uppercase, digits, special chars, and check if a password meets your custom policy. Instant feedback.
Find out the real destination of any shortened link (bit.ly, t.co, etc.) without clicking. Resolves redirects locally using public HTTP headers.
Escape HTML special characters to prevent XSS attacks, or unescape HTML entities back to original text. Essential for web developers. Runs locally.
Create a strong yet easy‑to‑remember passphrase from random common words. Combines 4‑6 words. Fully offline. XKCD compliant.
Hide a secret message inside a normal text using zero-width characters or invisible ink. Copy the result. Decode with the same tool.
Generate cryptographically secure BIP39 mnemonic phrases (12 or 24 words) for HD wallet seeds. All entropy generated locally.
Check if a URL can be embedded in an iframe. Test your site’s defense against clickjacking. Browser‑based.
Tell if your password has appeared in data breaches without sending the full password. Uses hash prefix locally.
Generate strong random strings for API tokens, session secrets, or encryption keys. Uses crypto.getRandomValues().
Enter a website and check which security headers (HSTS, CSP, X‑Frame‑Options) are present. Get a security grade.
Paste a Content‑Security‑Policy header and get a human‑readable breakdown. See potential risks and suggestions.
Generate a DKIM DNS record from a public key and selector. Check syntax. Improve your domain’s email deliverability.
Test a regular expression against malicious inputs to detect catastrophic backtracking and ReDoS vulnerabilities. Educational.
Paste a JWT and a public key or secret to verify the signature. Supports HS256, RS256, ES256. All operations local.
Validate a DNSSEC chain by entering DS and RRSIG records. Verify that signatures match. Educational. Local algorithm.
Fetch a site’s HSTS header and validate its syntax, max‑age, and subdomain flags. Ensure your site enforce HTTPS.
Convert plain text into HTML‑safe strings by escaping <, >, &, and quotes. Insert into code safely. Local copy.
Write notes that are encrypted in your browser before saving to localStorage. Only accessible with your passphrase.
Enter a password and see the estimated time it would take to crack using brute force at different speeds. Educational.
Test SQL injection inputs on a mock database and see the resulting query. Learn how to prevent SQLi. No real data.
Paste the Permissions‑Policy header and get a human‑readable table of allowed/blocked browser features. Understand how your site is restricted.