Tools › Security
Security
Make and check the things that keep systems safe: passwords, hashes, bcrypt, one-time codes, SSH keys and certificates. Decode certificates and PGP keys, encrypt a file, split a secret between people, spot lookalike characters, and see what your browser gives away.
SSH Key GeneratorMake a new SSH key pair in your browser: Ed25519, ECDSA or RSA, in the same files ssh-keygen writes, with its fingerprint and the commands to install it. The key never leaves the page.
Certificate MakerMake a certificate signing request (CSR) to send to a certificate authority, and a self-signed certificate for testing, with a new private key or one you already have. Host names, IP addresses and email addresses go in as alternative names.
Certificate DecoderPaste a PEM certificate, or a chain of them, or choose a .pem, .crt, .cer or .der file, to see its subject, issuer, validity dates (flagging expired ones), alternative names, key type and size, key usage, serial number and SHA-256 and SHA-1 fingerprints, with a check that a chain links up, and whether a private key belongs with it. Also reads certificate signing requests (CSRs) and SSH public keys.
What Your Browser RevealsEverything a web page can read about you without asking: browser, languages, time zone, screen, graphics chip, installed fonts, settings, permissions, and the fingerprint they add up to. Read here and shown to you only.
Lookalike CharactersPaste a link, domain, user name or text to find letters from other alphabets that pass for Latin ones (the Cyrillic а in pаypal), words that mix alphabets, invisible and text-direction characters, and see the punycode an address really uses.
PGP Key ViewerPaste or open an OpenPGP key, signature or message (GnuPG, Proton, OpenKeychain) to see its fingerprint, user IDs, algorithm, expiry, subkeys and uses, who made a signature and when, who a message is encrypted to, and problems such as weak or expired keys.
Hash / ChecksumMD5, SHA-1, SHA-2, SHA-3, BLAKE2, BLAKE3, RIPEMD-160, CRC-32 and Adler-32 of text or a file, HMACs with a key, and a check of a published hash that also says what kind of hash it is.
BcryptHash a password with bcrypt, PBKDF2, scrypt or NTLM, and check a password against a hash whose format it recognises, with the hash's cost and salt shown.
Encrypt / DecryptLock text or a file with a password using AES-256, in the same format as the openssl command, so either can open what the other makes.
Secret SplitterSplit a secret into shares so that any chosen number of them recovers it and fewer reveal nothing, then combine shares back into the secret.
Password GeneratorStrong passwords, XKCD-style passphrases of random words, PINs, API keys, hex and URL-safe tokens and slug IDs, with GRC's Password Haystack figures for how long a brute-force search would take, and a check of any password for common words and patterns.
TOTP / HOTP CodesThe current one-time code from an authenticator secret or otpauth:// link, the codes either side, a QR code to add it to an authenticator app, and a check of a code.
Guides
Getting an HTTPS certificate: from request to installedMake a certificate signing request with the right names, check what the certificate authority sends back, confirm the certificate matches your private key, put the chain in the right order, and check the site's security headers afterwards.
Sending a file only the right person can openLock a file with a password before you email or upload it, choose a password that holds up, send the password a different way, and check the file arrived unchanged.
Setting up an SSH key for GitHub or a serverMake an SSH key pair, add a passphrase, put the public key on GitHub or a server, fix the 'permissions are too open' error, choose the key for each host, and check which key is which by its fingerprint.
Strong passwords, two-factor codes and shared secretsStrong passwords and passphrases, two-factor codes and secrets split between people, all made and checked in your browser.