Help & Usage Guide

Confirms a file hasn't changed or been tampered with by comparing cryptographic checksums. Three modes: verify a file against a published hash, generate checksums for files, and snapshot a folder to detect changes over time.

1. Verify: choose a file, paste the expected checksum from the download page, and click Verify. A green match means the file is authentic.
2. Generate: select one or more files to produce their checksums, then download a manifest.
3. Compare snapshots: snapshot a folder now, save the JSON, and later compare a fresh scan to see what was added, removed, or modified.

Decodes a JSON Web Token into its header and payload, shows expiry status, and can verify HMAC signatures locally.

1. Paste a token into the box — the header and payload decode instantly.
2. Review the time claims (issued, expires) and the expired/valid badge.
3. For HS256/384/512 tokens, enter the secret and click Verify to confirm the signature.

Creates strong, random passwords or word-based passphrases with a strength meter.

1. Choose Password or Passphrase.
2. Adjust length (or word count) and character options.
3. Click Regenerate and copy the result.

Computes a hash of any text, or an HMAC signature with a shared secret.

1. Choose Hash or HMAC.
2. Enter text (and a secret for HMAC), pick an algorithm.
3. Click Compute and copy the hex result.

Formats, minifies, or validates JSON with clear error messages.

1. Paste JSON into the input.
2. Click Format to pretty-print, Minify to compact, or Validate to check.
3. Copy or download the output.

Encrypts text or files with a password using AES-256-GCM. Decrypt in the same tool, or with the downloadable offline decryptor. Symmetric: both sides share one password.

1. Encrypt: choose Text or File, enter your content and a password, then Encrypt. Text produces a shareable code; files download as a .fpx file.
2. Share the encrypted result and the password separately (e.g. password by a different channel).
3. Decrypt: the recipient uses the Decrypt tab (or the offline decryptor) with the same password.

Produces the 6- or 8-digit time-based codes an authenticator app generates, from a Base32 secret.

1. Paste the Base32 secret from your 2FA setup.
2. Set digits, period, and algorithm if they differ from the defaults (6 / 30s / SHA-1).
3. The current code and countdown display and refresh automatically.

Scans pasted text (config, .env, code, logs) for exposed secrets and API keys, showing masked matches by line.

1. Paste the text to scan.
2. Click Scan.
3. Review flagged findings — type, line number, and a masked snippet.

Generates cryptographically secure random tokens in hex, Base64URL, or alphanumeric.

1. Pick a format, size, and how many to generate.
2. Click Regenerate.
3. Copy any token.

Shows the metadata embedded in a photo — including GPS location — and downloads a clean copy with metadata removed.

1. Choose a JPEG or PNG image.
2. Review any metadata found (GPS coordinates are highlighted).
3. Click 'Download cleaned copy' to save a metadata-free version.

Converts text to Base64 and back (UTF-8 safe).

1. Choose Encode or Decode.
2. Enter your input.
3. Click the button and copy the output.

Identifies the likely algorithm behind a hash from its length and format (MD5, SHA-family, bcrypt, and more).

1. Paste a hash.
2. Review the candidate types listed.

Generates version-4 (random) UUIDs.

1. Set how many you need.
2. Click Regenerate.
3. Copy individual values or Copy all.