Network lookups, hashes, and security checks

Two kinds of tool sit together here. Some generate or inspect a value locally — passwords, hashes, UUIDs, TOTP codes, subnet ranges — and never send anything anywhere. Others have to reach out across the network to answer at all: DNS, WHOIS, SSL certificates, security headers, blacklist status. The ones that make a request say so, and they refuse to probe private or internal addresses.

All 24 Security Tools

Password GeneratorGenerate strong, random passwords.MD5 Hash GeneratorGenerate MD5 hash of any text.SHA256 HashGenerate SHA256 hash of any text.UUID GeneratorGenerate random UUIDs (v4).JWT DecoderDecode and inspect JWT tokens.IP CheckerCheck your public IP address and location.WHOIS LookupLook up domain registration info.DNS LookupCheck DNS records for any domain.Port ScannerScan common ports on a host.Email ValidatorValidate email address format and MX.CSR / Certificate DecoderDecode a PEM certificate or CSR to see subject, issuer, and validity.Password Strength CheckerCheck how strong a password is, with entropy estimation.Hash IdentifierIdentify the likely algorithm behind a hash string.HMAC GeneratorCompute a keyed HMAC hash of a message.Base32 EncoderEncode text to Base32 and decode Base32 to text.DMARC / SPF CheckerCheck a domain's SPF, DMARC, and DKIM email authentication records.Reverse DNS LookupLook up the hostname for an IPv4 address.SSL Certificate CheckerCheck a domain's SSL/TLS certificate details.Security Headers CheckerCheck which HTTP security headers a website sends.Blacklist CheckerCheck if an IP or domain is on common spam blacklists.TOTP / 2FA Code GeneratorGenerate a live TOTP code from a Base32 secret.MAC Address LookupGenerate a random MAC address or look up its vendor.CIDR / Subnet CalculatorCalculate network address, broadcast, and usable host range from a CIDR block.Bcrypt GeneratorGenerate a bcrypt hash from text, or check text against an existing hash.

Which one do you need?

The tools above overlap in places. This is the quickest way to pick the right one.

You need a strong password or passphrase: Password GeneratorGenerated in your browser from your device’s own cryptographic randomness.
You are diagnosing where a domain points: DNS LookupQueries records directly rather than showing your own resolver’s cache.
You want registration details for a domain: WHOIS LookupRegistrar, dates, and nameservers in one response.
You need to confirm a certificate is valid and current: SSL Certificate CheckerShows the chain and expiry, which is usually the actual problem.
You are hardening a site: Security Headers CheckerReports which protective headers are present and which are missing.
Your email is landing in spam: DMARC / SPF CheckerMissing or malformed sender-authentication records are the usual cause.
You are planning or reading a network range: CIDR / Subnet CalculatorNetwork and broadcast addresses and the usable host range from any CIDR.
You need to verify a file or string against a checksum: SHA256 HashComputed locally, so what you are hashing is never uploaded.

Frequently asked questions

Are generated passwords safe to use?

Yes. They are produced in your browser using your device’s cryptographic random number generator, and are never transmitted or stored. Nothing about a generated password reaches this site. Paste it straight into your password manager.

Can I hash or check a password here safely?

The hash generators and the strength checker run entirely in your browser, so nothing you type is sent anywhere. Even so, avoid pasting a password you actively use into any web page — check a representative example instead.

Do the lookup tools work on internal addresses?

No, deliberately. The tools that make server-side requests refuse loopback, link-local, and private ranges, so they cannot be used to probe internal networks or cloud metadata endpoints from our servers.

Why is my email going to spam?

Most often because SPF, DKIM, or DMARC records are missing, incomplete, or contradict each other, so receiving servers cannot confirm you are authorised to send for the domain. The DMARC/SPF checker reports what is published, and the blacklist checker shows whether your sending IP has been listed.

Does the SSL checker test my private key?

No, and it never asks for one. It inspects the public certificate a server presents, exactly as a browser does. Never paste a private key into a web page.