Security Tools

ArrayKit's security tools handle the passwords, hashes, tokens, keys and certificates that come up when you build or run software. Create a random password with the Password Generator or a word-based passphrase with the Diceware Passphrase Generator, and test any password with the Password Strength Checker. Hash text with the Hash Generator or MD5 Hash Generator, and check a download against its published checksum with File Hash Checksum. For sign-in and APIs, read a token's claims in the JWT Decoder, sign a test token with the JWT Signer, create or verify bcrypt password hashes with the Bcrypt Generator, and get 2FA codes from a secret with the TOTP / 2FA Generator. The HMAC Generator computes webhook signatures, and other tools build Basic Auth headers and check a Content-Security-Policy for risky directives. For servers and TLS, the SSH Key Generator creates Ed25519, RSA and ECDSA keypairs, and the X.509 Certificate Decoder and CSR Decoder show what a certificate or signing request contains. Before you share or open a document, the PDF Privacy Scanner finds hidden metadata and personal data, Auto-Redact PDF blacks out emails, phone numbers and ID numbers, and PDF Sanitizer strips scripts and auto-run actions from files you did not create. They are built for developers, sysadmins and IT teams. Everything runs in your browser, so passwords, keys, tokens and files are processed on your device and never uploaded.

  • JWT Decoder — Decode JWT header & payload and inspect exp / iat (no verification).
  • Hash Generator — SHA-256 / SHA-1 / SHA-384 / SHA-512 via the Web Crypto API.
  • Password Generator — Generate strong, random passwords with a strength meter (crypto-secure).
  • SSH Key Generator — Generate Ed25519, RSA or ECDSA SSH keypairs in your browser and download the public and private keys.
  • PPK ↔ PEM Converter — Convert SSH private keys between PuTTY .ppk and OpenSSH/PEM (RSA & Ed25519) — locally in your browser.
  • TOTP / 2FA Generator — Generate time-based one-time passwords (2FA codes) from a base32 secret.
  • JWT Signer — Create and sign a JWT (HS256/384/512) from a payload and secret — Web Crypto.
  • Basic Auth Generator — Generate and decode HTTP Basic Auth Authorization headers from a username and password.
  • Certificate & Private Key Matcher — Confirm an X.509 certificate or CSR and a private key belong together (the classic modulus mismatch check) — locally in your browser.
  • PFX to PEM Extractor — Open a password-protected .pfx/.p12 file and split it into certificate, chain, and private-key PEM blocks.
  • Bcrypt Generator — Hash a password with bcrypt and verify a password against a bcrypt hash, in your browser.
  • HMAC Generator — Generate an HMAC (SHA-256, SHA-1, SHA-512) from a message and secret key using Web Crypto.
  • Password Strength Checker — Check password strength with entropy, character-set and common-pattern analysis, in your browser.
  • X.509 Certificate Decoder — Decode a PEM or DER certificate to view subject, issuer, validity, SANs and fingerprints.
  • Diceware Passphrase Generator — Generate a memorable, high-entropy passphrase from the EFF word list, in your browser.
  • CSP Analyzer — Parse a Content-Security-Policy header into a directive table with warnings and explanations.
  • File Hash Checksum — Compute MD5, SHA-1, SHA-256 and SHA-512 checksums of files and compare against an expected hash.
  • IBAN Generator & Validator — Generate valid test IBANs by country and validate any IBAN with MOD-97 check digits.
  • AES Encrypt / Decrypt — Encrypt and decrypt text with AES-GCM and a passphrase, using Web Crypto in your browser.
  • SHA-3 & Keccak Hash Generator — Hash text or hex with SHA-3, Keccak-256 and SHAKE, for Ethereum and general use.
  • MD5 Hash Generator — Generate an MD5 hash of text or a file, in your browser.
  • CRC32 Checksum Calculator — Compute a CRC32 checksum of text or a file as hex and decimal, in your browser.
  • CSR Decoder — Read a certificate signing request: subject, SANs, key size and signature check.
  • PDF Privacy Scanner — Find the metadata and personal data hiding inside a PDF.
  • Auto-Redact PDF — Find emails, phone numbers, card and ID numbers across a PDF and black them out.
  • Remove PDF Restrictions — See which actions a PDF blocks and lift the permission flags on a file you own.
  • PDF Sanitizer — Remove JavaScript, auto-run actions, embedded files and other active content from a PDF.

Guides

  • Cryptographic Hash Functions, Explained — What a cryptographic hash is, how MD5, SHA-1, SHA-256 and SHA-512 compare, how checksums verify downloads, and why fast hashes are wrong for passwords.
  • Strong Passwords, Explained — What makes a password strong: length vs complexity, password entropy in bits with worked numbers, passphrases, password managers and current NIST advice.
  • JSON Web Tokens (JWT), Explained — A complete guide to JWTs: the three-part structure, header and payload claims, signing algorithms, decoding vs verifying, and the security pitfalls to avoid.

Frequently asked questions

What can I do with ArrayKit's security tools?
Generate passwords, passphrases and 2FA codes and test how strong a password is. Hash text with SHA-1, SHA-2, SHA-3, MD5, CRC32, HMAC or bcrypt, compute file checksums, decode JWTs (without verifying the signature), sign test tokens and encrypt text with AES. You can also create and convert SSH keys, decode certificates and signing requests, build Basic Auth headers, review a Content-Security-Policy and generate test IBANs. For PDFs, there are tools to find hidden personal data, redact it, strip active content and remove printing or copying restrictions from files you are entitled to use.
How do I create a strong password or passphrase?
Open the Password Generator, set a length of up to 64 characters and the character sets you need; it draws on your browser's cryptographically secure random generator and shows the estimated entropy. If you have to remember or type the secret, the Diceware Passphrase Generator picks four to twelve words from the EFF large wordlist instead. To judge an existing password, the Password Strength Checker shows its entropy, a rough crack-time estimate and the patterns that weaken it.
Are my passwords, keys and files sent anywhere?
No. Every security tool runs in your browser: passwords and keys are generated on your device, and the tokens, certificates and documents you paste or drop are processed locally and never uploaded. Treat what you generate as a real secret and keep it in a password manager or key store rather than a note or chat message.
Which hash algorithm should I use?
To check a download, compare its SHA-256 checksum: File Hash Checksum computes it along with MD5, SHA-1 and SHA-512 and matches the result against the published value. MD5 and CRC32 are fine for catching accidental corruption but not for security, and passwords belong in a slow, salted hash such as bcrypt, which the Bcrypt Generator creates and verifies. Use the SHA-3 & Keccak Hash Generator when a system asks for SHA3-256 or Ethereum's Keccak-256, and the HMAC Generator when a message must be signed with a shared secret.
Can I inspect SSL certificates and convert SSH keys here?
Yes. The X.509 Certificate Decoder shows a certificate's subject, issuer, validity dates, SANs and fingerprints, the CSR Decoder checks a signing request before it goes to the CA, and the Certificate & Private Key Matcher confirms that a certificate or CSR and an RSA private key belong together. The PFX to PEM Extractor splits a .pfx or .p12 bundle into PEM blocks, and the PPK ↔ PEM Converter moves RSA and Ed25519 keys between PuTTY and OpenSSH formats.