-----BEGIN TOOLKIT-----
FREE ONLINE ENCRYPTION & CRYPTOGRAPHY TOOLSTwo thousand years of secrets, one toolbox.
From Caesar's shift to AES-256 — 62 working cryptography tools that run entirely in your browser. Your keys, passwords, and plaintext never touch a server.
HASHED IN YOUR BROWSER AS YOU TYPE — THE WAY EVERY TOOL HERE WORKS
Popular cryptography tools
Symmetric Encryption
VIEW ALL →Encrypt and decrypt text with a shared secret key. Modern authenticated ciphers and legacy block modes, running entirely in your browser.
AES Encryption
Encrypt text with AES-256 in GCM, CBC, or CTR mode
XOR Cipher
Bitwise XOR with a repeating key, plus single-byte bruteforce
ChaCha20-Poly1305
Modern authenticated stream cipher, password-based
Salsa20
The stream cipher that ChaCha20 was built from
RC4 Stream Cipher
The classic (broken) stream cipher, for education and interop
Triple DES & DES
Legacy DES and 3DES block cipher tool
Blowfish & Twofish
Blowfish and Twofish encryption suite
Camellia
Camellia block cipher tool
CAST-128 & CAST-256
CAST family cipher utility
Public-Key Cryptography
VIEW ALL →Generate key pairs, exchange keys, and encrypt with RSA and elliptic curves. Keys are generated locally and never uploaded.
RSA Key Generator
Generate RSA key pairs and export them as PEM
RSA Encrypt / Decrypt
Encrypt with a public key, decrypt with a private key
ECC Key Generator
Generate P-256, P-384, and P-521 key pairs as PEM
Ed25519 / X25519 Keys
Modern Curve25519 signing and key-exchange keys
PGP Encrypt / Decrypt
Encrypt with a public key, decrypt with a private key
PGP Key Generator
Generate a modern Curve25519 PGP key pair in your browser
Diffie-Hellman Simulator
Watch two parties agree on a shared secret over a public channel
SSH Key Generator
Generate an Ed25519 SSH key pair with OpenSSH public key output
SSH Key Inspector
Read the algorithm, bit length, and fingerprints of any SSH key
Hashing & Checksums
VIEW ALL →One-way functions for integrity, authenticity, and identity. Hash text and files with every digest from CRC8 to SHA-512.
SHA Hash Generator
Every SHA digest of your text, computed live
MD5 Generator
Legacy MD5 digests for checksums and lookups
HMAC Generator
Keyed message authentication codes
CRC Checksum
Cyclic redundancy checks for data integrity
File Checksum
Drag a file, get its hashes, compare against a published sum
SHA-3 / Keccak
The newest NIST hash standard, plus Ethereum's Keccak-256
BLAKE2 & BLAKE3
The fastest modern cryptographic hashes
RIPEMD-160
The 160-bit hash Bitcoin uses for addresses
Whirlpool & GOST
ISO and GOST standard hashes
Password Hashing & KDF
VIEW ALL →Slow, salted, memory-hard functions built to protect credentials and derive keys from passwords.
PBKDF2 Derivation
Derive keys from passwords with salt and iterations
Argon2 Hasher
The password-hashing competition winner, memory-hard
Bcrypt Hasher
Hash and verify passwords with the bcrypt standard
Scrypt Calculator
Memory-hard key derivation with tunable N, r, p
NTLM Hasher
The MD4-based hash Windows stores for local accounts
Cisco Type 7
Reverse Cisco IOS Type 7 password obfuscation
htpasswd Generator
Create Apache/Nginx basic-auth password entries
PKI & Certificates
VIEW ALL →Inspect, decode, and convert the certificate formats that underpin TLS — PEM, DER, and raw ASN.1 structures.
PEM ⇄ DER Converter
Convert between ASCII-armored PEM and binary DER
ASN.1 Parser
Decode DER hex or PEM into a readable ASN.1 tree
X.509 Certificate Parser
Decode a PEM certificate into readable fields
CSR Decoder
Inspect the subject and key inside a PKCS#10 CSR
PKCS#12 Extractor
.pfx / .p12 key extractor
PKCS#7 Inspector
Decode a .p7b certificate bundle structure
Chain Validator
Certificate chain and root CA checks
Encoding & Radix
VIEW ALL →The formats data travels in — Base64, hex, URL escapes, JWTs, and every radix in between.
Base64
Encode and decode Base64, with URL-safe variant
Base32 / 58 / 85
The other bases: RFC 4648, Bitcoin, and ASCII85
Hex ⇄ Text
Bytes as hex, hex as bytes
Base Converter
Arbitrary-precision conversion between bases 2–36
URL Encoder
Percent-encoding for URLs and query strings
HTML Entities
Escape and unescape HTML special characters
JWT Debugger
Decode JSON Web Tokens and verify HMAC signatures
ROT13 / ROT47
The self-inverse alphabet rotations
Morse Code
Text to Morse and back, with playable audio
Punycode Converter
Convert internationalized domains to and from xn-- ASCII
Classical Ciphers & CTF
VIEW ALL →Two thousand years of pen-and-paper cryptography — and the analysis tools that break it. Built for learning and Capture The Flag.
Caesar Cipher
Shift cipher with instant all-25 bruteforce
Vigenère Cipher
The polyalphabetic cipher that resisted breaking for 300 years
Atbash & Affine
Mirror-alphabet and modular substitution ciphers
Rail Fence Cipher
Zigzag transposition across configurable rails
Baconian Cipher
Francis Bacon's five-bit steganographic alphabet
Polybius & Tap Code
Coordinate ciphers from ancient Greece to POW camps
Frequency Analysis
Letter statistics, index of coincidence, chi-square
Enigma Machine
The WWII cipher machine, with rotors, rings, and plugboard
Playfair Cipher
The digraph cipher with a 5×5 keyed square
One-Time Pad
The only provably unbreakable cipher — if used correctly
Randomness & Secrets
VIEW ALL →High-entropy passwords, passphrases, identifiers, and codes — generated by your browser's CSPRNG, never by a server.
Password Generator
High-entropy passwords with a live strength meter
Passphrase Generator
Memorable word-based passphrases, diceware style
UUID Generator
Random v4 and time-ordered v7 UUIDs, in bulk
TOTP Generator
Live 2FA codes from a Base32 secret
API Key Generator
Random tokens in hex, Base64, or prefixed formats
Random Numbers
Unbiased integers, dice, and raw bytes from the CSPRNG
BIP-39 Mnemonic
Generate and validate wallet recovery phrases, derive the seed
Wi-Fi QR Builder
Make a scannable QR code that joins your network
Burn-After-Reading Link
Zero-knowledge secret sharing
Learn the decisions behind the tools.
ALL 11 GUIDES →Encoding vs Encryption vs Hashing: The Difference, With Examples
Encoding, encryption and hashing all turn data into gibberish, but only one keeps secrets. Learn the difference with real Base64, AES and SHA-256 examples and when to use each.
6 MIN READSYMMETRIC · AESAES-GCM vs CBC vs CTR vs ECB: Which AES Mode Should You Use?
AES is only as safe as its mode. Compare ECB, CBC, CTR and GCM — how each works, how each fails, and why AES-GCM (or ChaCha20-Poly1305) is the right default in 2026.
7 MIN READKDF · PASSWORDSArgon2id vs bcrypt vs scrypt vs PBKDF2: Password Hashing in 2026
Which password hashing algorithm should you use? A practical comparison of Argon2id, bcrypt, scrypt and PBKDF2 with OWASP-recommended parameters, hash formats, pitfalls and migration steps.
6 MIN READHASHING · HOW-TOHow to Verify a SHA-256 Checksum on Windows, macOS and Linux
Step-by-step commands to check a file's SHA-256 hash on Windows (PowerShell, certutil), macOS and Linux — plus how to verify the checksum file itself with GPG, and what a mismatch means.
5 MIN READHASHING · SECURITYIs MD5 Still Safe? When MD5 and SHA-1 Are (and Aren't) OK to Use
MD5 and SHA-1 are broken — but not for everything. Learn exactly which attacks exist, where MD5 and SHA-1 are still acceptable, where they are dangerous, and what to use instead.
5 MIN READJWT · WEB SECURITYHow to Decode a JWT — and 7 Security Mistakes That Get Tokens Forged
What's inside a JSON Web Token, how to decode and verify one safely, and the real-world JWT vulnerabilities — alg:none, key confusion, weak secrets — with the fix for each.
6 MIN READYour secrets never leave the browser.
Nothing is uploaded
Every tool runs client-side with the Web Crypto API and audited open-source libraries. Your keys, passwords, and plaintext are processed on your device and never sent to a server.
No account, no ads
There is nothing to sign up for and nothing to install. Open a tool and use it — free, with no tracking of what you encrypt or hash.
Real, verifiable crypto
Modern tools use the browser's native Web Crypto and vetted libraries like @noble and OpenPGP.js. Classical ciphers are checked against published test vectors.