Security tools where pasting into a website is the risk
This is the category where online tools are genuinely dangerous. A JWT from your staging environment is a working credential. A production connection string, an API secret, a password you are testing, a TOTP seed: pasting any of them into a server-side tool means handing a stranger something that still works.
Everything here uses the browser's own Web Crypto API and never opens a network connection with your input. You can verify that: open DevTools, switch to the Network tab, and use the tool.
11 Security tools
Compute SHA-1/256/384/512 digests and HMACs in your browser via Web Crypto.
Generate strong random passwords and encryption keys (hex/base64) in your browser.
Encrypt or decrypt text with AES-256-GCM and a passphrase (PBKDF2), all local.
Generate an RSA public/private key pair in PEM format, in your browser via Web Crypto.
Hash a password with bcrypt at a chosen cost, or verify one against a hash, locally.
Generate time-based one-time codes (RFC 6238) from a secret, with a QR code and validator, locally.
Estimate a password's entropy and crack time from its character sets, locally.
Turn a username and password into an HTTP Basic Authorization header, locally.
Generate and validate BIP39 recovery mnemonics with entropy and seed, locally.