Encrypt a message before you send it
AES Text Encryption protects text with AES-256-GCM, deriving the key from your passphrase with PBKDF2-SHA256 at 250,000 iterations. Every message gets a fresh random salt and IV, so encrypting the same text twice produces entirely different output. GCM is authenticated, meaning it detects tampering as well as concealing content — if a byte changes in transit, decryption fails rather than producing corrupted text. Send the passphrase over a different channel from the message; emailing both together is the same as emailing plaintext.
Store passwords properly
bcrypt remains the sensible default, and its cost factor is exponential rather than linear — 12 is four times the work of 10, not twenty per cent more. That slowness is the security property: a login performs one hash while cracking a leaked database performs billions. The bcrypt tool reports actual elapsed time so the cost curve is felt rather than guessed, and verify mode checks a password against an existing hash. Worth knowing: bcrypt silently truncates input beyond 72 bytes, which catches people out when hashing long generated tokens.
Generate keys and sign tokens
The RSA and EC Key Pair Generator creates keys in your browser using the operating system's randomness, exporting PKCS#8 and SPKI PEM plus JWK. EC keys are far smaller for equivalent strength — P-256 is roughly comparable to RSA-3072 — while RSA stays the safer choice for older systems. The JWT Signer mints test tokens with HS256, HS384 or HS512 and enforces the minimum key length each algorithm requires. Remember that a JWT payload is base64, not encryption: anyone holding the token can read every claim.
Verify what you downloaded, and handle 2FA
The Checksum Verifier computes SHA-256, SHA-384, SHA-512, SHA-1 and CRC32 at once and highlights whichever matches the value you paste. A match proves your copy is byte-identical to the one that was hashed — it says nothing about whether the publisher is trustworthy, and nothing at all if the checksum came from the same page as a tampered download. The TOTP Generator computes 2FA codes from a Base32 secret, which is genuinely useful for testing an implementation or recovering access, but is not a replacement for an authenticator app.