Browser-Based Security & Utility Tools
Free security, developer and everyday tools from Sefat Khan, Technology & Digital Creator, grouped by category. The tools process what you type or choose in your browser and do not send it to any server. Security references are for education and authorized testing only.
Password strength checker
Type a password to see its strength.
A rough estimate based on length and character variety, calculated in your browser. Avoid typing passwords you use for real accounts into any online tool; use a unique passphrase and a password manager instead.
Password generator
Generated locally using the browser’s cryptographically secure random number generator.
Hash generator
SHA-1 is shown for compatibility only; it is not recommended for security purposes.
Hash cracker (educational dictionary demo)
Checks the hash against a short built-in list of common passwords, hashed in your browser.
Educational demo. The list is small, so most real hashes will not match. Use it only on hashes you created or are authorized to test.
Encoding / decoding suite
Encoding is not encryption: Base64, URL, hex and ROT13 provide no secrecy.
JWT token decoder
Decodes in your browser and does not verify the signature, so a decoded token is not proof that it is valid. Avoid pasting live production tokens.
File upload & analysis
The file is read in your browser to compute its SHA-256 hash and basic details; the tool does not upload it. This is not a malware scanner.
Text analyzer
Code scanner (static patterns)
Flags common risky patterns (eval, innerHTML, hard-coded secrets, SQL string concatenation). A lightweight pattern check, not a full static analyzer. Your code is only searched as text and is never run.
URL analyzer
Splits the URL into its parts in your browser. It does not visit or scan the address.
HTTP header analyzer
Checks for common security headers. Browsers block cross-origin header fetches, so paste headers from your browser’s Network tab. This only checks whether each header name is present, not whether its value is safe.
Caesar cipher
A classic teaching cipher. It is easy to break and is not secure encryption.
SQL injection examples (educational reference)
Educational reference. Common example strings used to explain and test for SQL injection. Use them only in your own test environments or with written permission. Some examples, such as DROP TABLE, can destroy data if run against a real database.
' OR '1'='1' OR '1'='1' --admin'--' UNION SELECT NULL,NULL,NULL--1' AND 1=CONVERT(int,(SELECT @@version))--' OR SLEEP(5)--'; DROP TABLE users;--1 OR 1=1' OR 'a'='aadmin' OR '1'='1'#
XSS examples and probe builder (educational reference)
Educational reference. Basic example strings used to explain and test for cross-site scripting. Use them only in your own test environments or with written permission.
<script>alert(1)</script><img src=x onerror=alert(1)>"><script>alert(document.cookie)</script><svg onload=alert(1)>javascript:alert(1)<body onload=alert(1)><iframe src=javascript:alert(1)>'><img src=x onerror=alert(String.fromCharCode(88,83,83))>
Reverse shell command generator (authorized testing only)
Authorized testing only. For lab, CTF and written-scope penetration-testing use. Running these commands against a system you do not own or have permission to test is illegal.
Use only addresses and ports you control. Leave the fields empty to see example values.
Common ports reference
| Port | Service | Description |
|---|---|---|
| 21 | FTP | File transfer |
| 22 | SSH | Secure shell |
| 23 | Telnet | Unencrypted remote login |
| 25 | SMTP | Mail transfer |
| 53 | DNS | Domain name resolution |
| 80 | HTTP | Web traffic |
| 110 | POP3 | Mail retrieval |
| 143 | IMAP | Mail retrieval |
| 443 | HTTPS | Encrypted web traffic |
| 445 | SMB | Windows file sharing |
| 3306 | MySQL | Database |
| 3389 | RDP | Remote desktop |
| 5432 | PostgreSQL | Database |
| 6379 | Redis | In-memory store |
| 8080 | HTTP-alt | Common proxy/app port |
| 27017 | MongoDB | Database |
This is a static reference, not a live scanner — browsers can’t open raw sockets. Use Nmap from an authorized host for real scans.
Markdown previewer
Renders a safe subset of Markdown (headings, bold, italic, code, links, lists) locally. Output is escaped before formatting, so no HTML you type is executed.
Color contrast checker
Checks against WCAG 2.1 contrast ratios (4.5:1 normal text / 3:1 large text for AA, 7:1 / 4.5:1 for AAA). Accepts hex colors like #0a0f0d.
Text case & slug converter
Diff checker
Compares line by line locally in your browser.
Random data generator
For test and placeholder data. The UUID, MAC and hex options use the browser’s secure random generator; the IPv4, email and name options do not.
Log analyzer
Counts IP addresses and HTTP status codes found in the pasted text — useful for a quick first look at access logs.
Unit converter
Converts locally using standard unit definitions.
Number base converter
Timestamp converter
Converts locally using your browser’s clock and timezone.
BMI calculator
BMI is a rough screening measure, not a diagnosis — it doesn’t account for muscle mass, age or body composition.