A crypto workbench that runs where the secret already is: your tab
Most "online encryption" sites are a trap for anyone who understands the threat model. You paste a plaintext, a passphrase, or a private key into a form, hit submit, and that data crosses the wire to somebody else's server before you ever see a result. For a security engineer, that is not a convenience — it is a breach you performed on yourself. SafeWebTools was built for the opposite instinct. Every primitive here executes locally through the browser's SubtleCrypto Web Crypto API and the DOM, which means the bytes you feed in are transformed in the same JavaScript context that rendered the page. Open your DevTools Network tab while you run the AES encryptor or the SHA-256 hash generator and watch it stay silent: there is no XHR carrying your data, because there is nowhere for it to go.
That single property changes how you can use these tools day to day. You can hash a production database dump, derive a key from a real passphrase, or generate an RSA private key that will actually protect something — because the material never touches a log file, a reverse proxy, or an analytics beacon. The trade-off is honest and worth stating: client-side crypto trusts the page you loaded and the machine you loaded it on. If your endpoint is compromised, nothing on the web can save you. But for the everyday work of verifying a checksum, testing a webhook signature, or scaffolding keys for a staging environment, keeping computation on-device is exactly the discipline you want, and it is the whole reason this toolbox exists.
Hashing, checksums and password storage — the primitives you reach for most
The Hash Generator covers MD5, SHA-1, SHA-256 and SHA-512 over both raw text and dropped files, which makes it the fastest way to answer "did this artifact change?" A word of warning that this site takes seriously and that our blog on choosing a hash algorithm expands on: MD5 and SHA-1 are cryptographically broken. Use them only for non-adversarial fingerprinting — cache keys, deduplication, matching a mirror's published checksum — and reach for SHA-256 the moment an attacker might have a motive to forge a collision. The File Checksum Verifier is the practical companion here: drag in a downloaded ISO or release tarball, compute its digest, and paste the maintainer's published value to compare. It is the two-second habit that catches a tampered download or a truncated transfer before you run it.
Password storage is its own category, and the Bcrypt Hash Generator & Verifier respects that. Bcrypt is deliberately slow, salted per-hash, and tunable through a cost factor, which is precisely why you should never store a raw SHA-256 of a password. Generate a hash at a realistic cost (10 to 12 for most web apps), then use the verifier to confirm a plaintext matches an existing $2b$ digest — handy when you are debugging a login flow and need to prove the stored hash is correct without spinning up your backend. Pair it with the Password Strength Analyzer, which reports entropy in bits and an estimated crack time rather than a vague "weak/strong" badge, so you can reason about resistance to offline brute force in numbers instead of adjectives.
Encryption, signatures and keys for real workflows
When you need confidentiality rather than a one-way digest, the AES Text Encryptor / Decryptor uses AES-256-GCM with a PBKDF2-derived key. GCM is authenticated encryption, so it does not just hide the plaintext — it detects tampering, and decryption fails loudly if a single byte of ciphertext or the passphrase is wrong. That makes it a sound choice for sharing a short secret with a colleague over a channel you do not fully trust: encrypt locally, send the ciphertext, share the passphrase out of band. The HMAC Signature Generator handles the other half of message integrity, computing HMAC-SHA-256, SHA-384 or SHA-512 signatures. If you have ever had to verify a Stripe, GitHub, or generic webhook payload, you know the ritual — concatenate the signing secret with the raw body, hash it, and compare against the header. This tool lets you reproduce that signature by hand and confirm your server-side verification code is doing the right thing.
For asymmetric work, the RSA Key Pair Generator produces genuine 2048-bit or 4096-bit keys through the Web Crypto API and hands you PEM-formatted public and private halves you can drop straight into an SSH config test, a JWT signing experiment, or a TLS lab. Because generation happens locally, the private key is never transmitted — which is the only acceptable way to generate a private key online. Rounding out the set, the Base64 Encoder / Decoder handles both standard and URL-safe alphabets over text and files, the daily glue for embedding a small asset in a data URI, decoding a JWT segment, or unpacking a base64 field from an API response. Our guide on public-key cryptography without the math is a good companion if the relationship between these pieces — keys, signatures, and the chain of trust behind HTTPS — still feels abstract.
2FA tooling, and how to fold these into your routine
Two-factor secrets deserve their own careful handling, and three tools here cover the lifecycle. The TOTP / 2FA Code Generator takes a Base32 secret and shows live six-digit codes refreshing on the standard 30-second window, which is invaluable when you are testing an authenticator integration and do not want to reach for your phone on every iteration. The QR Code Generator for 2FA Secrets renders a scannable otpauth:// code entirely in the browser, so you can enroll a real authenticator app without a third-party server ever seeing the seed. And the 2FA Backup Code Generator produces a batch of cryptographically random one-time recovery codes — the printout you tuck away for the day you lose your device. Alongside these sit familiar network and site utilities such as DNS Lookup, WHOIS, SSL Certificate Checker and HTTP Header Checker, so an incident-response session or a pre-launch audit stays in one place.
The workflow that ties it together is simple discipline. Verify every download's checksum before you trust it. Reason about password strength in entropy, not vibes. Store credentials with bcrypt and a sane cost factor, never a bare hash. Reproduce webhook signatures with HMAC when integrations misbehave, and generate keys locally so a private key is born and stays on your machine. None of these are exotic; they are the small, repeatable habits that separate engineers who merely use cryptography from those who wield it correctly. Bookmark the tools you touch weekly, keep this tab open during your next audit, and let the browser do the math while your secrets stay exactly where they started.