go-supertools
Categories · 80 tools

Security & Privacy Tools

Generate and test passwords and keys, hash and encrypt data, and check a website’s security setup.

Passwords & keys

7

SSH Key Generator

Generate an SSH key pair (Ed25519, RSA or ECDSA) in OpenSSH format, with an optional passphrase.

Password Generator

Create secure passwords

Password Strength Test

Score a password out of 100 by length, character variety, repeats and sequences.

Password Crack Time Calculator

See how long a password policy, or one password, takes to brute-force at several attacker speeds, from a throttled login to a GPU farm.

Pwned Password Check

Check if a password appears in known data breaches without sending the password.

Random Secret Key Generator

Generate high-entropy random keys for APP_KEY, JWT secrets, and secure application credentials.

UUIDv4 Generator

Generate random version 4 UUIDs, up to 100 at a time.

Hashing & encryption

8

Hash Generator

Generate different hashes.

HMAC Generator

Compute an HMAC (SHA-256, SHA-512, SHA-384 or SHA-1) of a message with a secret key.

MD5 Generator

Calculate MD5 Hashes

SHA Generator

Calculate SHA Hashes

Bcrypt Generator

Generate bcrypt password hashes with an adjustable cost factor, or check whether text matches an existing bcrypt hash, all in your browser.

SRI Hash Generator

Generate Subresource Integrity (SRI) hashes and script or link tags for a file.

Hash Identifier

Find out which algorithm probably produced a hash: MD5, SHA-1, bcrypt, NTLM and more.

AES-256 Encryption/Decryption

Encrypt and decrypt text with AES-256-GCM and a passphrase, entirely in your browser.

Website security

28

TLS Cipher Suite Lookup

Look up TLS cipher suites by IANA or OpenSSL name or hex ID, and see key exchange, cipher, forward secrecy and a security rating.

Permissions-Policy Header Generator

Build a Permissions-Policy header to switch off browser features such as camera, microphone and geolocation.

SSL Checker

Check whether a site's SSL/TLS certificate is valid, who issued it and when it expires.

Security Headers Auditor

Check which common security headers a website sends.

Security Headers & WAF Auditor

Audit security headers, detect WAF, and visualize protection.

Safe Browsing Checker

Check whether a domain is flagged for malware or phishing.

CSP Header Generator

Create secure Content Security Policy (CSP) headers for your website.

Security.txt Generator

Create a security.txt file to help researchers report vulnerabilities.

CVE Lookup Tool

Search and analyze Common Vulnerabilities and Exposures (CVE) details.

CVSS Calculator

Calculate a CVSS 3.1 or 3.0 score from a vector or by choosing metrics.

CVSS Finding Write-up Generator

Turn a CVSS 3.x vector and your notes into a finished vulnerability report: severity, plain-language metric breakdown, steps, impact and remediation.

Dependency Vulnerability Scanner

Scan a lockfile for known vulnerabilities. The file is read in your browser; only package names and versions are sent.

CSP Evaluator

Check a Content-Security-Policy for weaknesses and see how to fix each one.

Certificate & CSR Decoder

Read an X.509 certificate or CSR: names, dates, key, extensions and problems.

ASN.1 Decoder

Decode DER data (certificates, keys, signatures) into its element tree.

PKCE Code Verifier & Challenge Generator

Generate a PKCE code verifier and its S256 code challenge for OAuth 2.0.

TOTP Code Generator

Generate time-based one-time passwords (2FA codes) from a base32 secret.

SAML Decoder

Decode a SAMLRequest or SAMLResponse and see the issuer, user, conditions and attributes.

JWT Security Analyzer

Grade a JWT for weaknesses: alg none, key-injection headers, missing or long-lived claims, sensitive data, and well-known weak HMAC (HS256/384/512) secrets.

Secret Scanner

Find leaked API keys, tokens, private keys and passwords in text or files, in your browser.

.env File Analyzer

Check a .env file for leaked secrets, keys that end up in the browser bundle, debug flags, weak values and parsing traps. Values stay masked.

Cookie Security Analyzer

Paste Set-Cookie headers and see what browsers will keep or reject, with Secure, HttpOnly, SameSite, prefix and lifetime checks.

CORS Policy Analyzer

Paste several CORS probe results and see which origins a browser would let read the response, with the weaknesses that follow.

YARA Rule Builder

Write a YARA rule from a form: text, hex and regex strings with modifiers, file-type and size checks, a condition and metadata.

Sigma Rule Builder

Write a Sigma detection rule from a form: log source, field conditions with match types, exclusions, ATT&CK tags and metadata.

TLS Fingerprint Explainer (JA3 & JA4)

Compute and explain JA3 and JA4 TLS fingerprints from a ClientHello, or explain a JA3 string or JA4 value, with cipher, extension and curve names.

Key & CSR Generator

Generate an RSA, ECDSA or Ed25519 key pair and a certificate signing request (CSR) in your browser.

Email (.eml) Analyzer

Check an email for phishing signs: sender mismatches, failed authentication, tricky links and risky attachments.

Recon & bug bounty

13

Subdomain Permutation Generator

Turn subdomains you already know into likely new names: extra words, number steps, environment swaps and dropped labels.

Scope Checker

Paste a pentest or bug bounty scope, then check hosts, URLs and IPs: in scope, out of scope or excluded, with the rule that decided.

URL Recon Analyzer

Paste a list of URLs from a crawl or archive and get them de-duplicated and grouped by host, endpoint pattern, file type and parameter, with hints on what deserves a look.

Endpoint & JavaScript Endpoint Extractor

Pull URLs, API paths and routes out of JavaScript, HTML or JSON, with how each is used (fetch, axios, XHR, router) and the HTTP method where the code states it.

Parameter Miner

Collect parameter names from URLs, HTML forms, JavaScript, JSON bodies, path templates and GraphQL variables you already have, and see where each appears.

HAR Security & Recon Analyzer

Analyze a browser HAR file: hosts, endpoints, parameters, security findings in the traffic, and a redacted copy that is safer to share.

HTTP Request & Response Analyzer

Paste raw HTTP requests or responses and get them parsed, with framing and header problems, credentials, parameters and security findings explained.

Source Map Analyzer

Open a JavaScript source map and see what it exposes: original files, embedded source code, secrets, local paths and bundled packages, with a ZIP of the sources.

Recon Wordlist Generator

Build a target-specific discovery wordlist from pages, scripts and URLs you already have: words, paths, parameters and subdomain labels, ranked by frequency.

Domain Mutation Generator

List the typo, look-alike and keyword variants of your domain that attackers register, as text for brand monitoring, blocklists and takedown preparation.

Nuclei Command & Template Builder

Build a nuclei command from choices, or write a nuclei detection template as YAML with matchers and extractors, checked against the official flag list and template schema.

Web Recon & Security Report Builder

Turn your scope, recon lists and findings into a clean, escaped report as Markdown and as a self-contained HTML page, with CVSS scores and secret masking.

SSH Key & authorized_keys Analyzer

Read SSH public keys, certificates and authorized_keys lines: type, size, fingerprints, certificate details and a numbered security ruleset. Private keys are refused.

Config & pipeline review

5

sshd_config & ssh_config Analyzer

Check an sshd_config or ssh_config for risky settings: root and password login, weak ciphers, forwarding, host key checking. Shows the effective values with Match and Host blocks applied.

GitHub Actions Workflow Security Analyzer

Check a GitHub Actions workflow for script injection, dangerous triggers, unpinned actions, broad token permissions and leaked secrets. Runs in your browser, nothing is uploaded.

Dockerfile & Docker Compose Security Analyzer

Check a Dockerfile or docker-compose.yml for root users, secrets, latest tags, privileged containers, exposed database ports and the Docker socket. Runs in your browser.

OpenAPI / Swagger Security Analyzer

Check an OpenAPI or Swagger definition for unprotected operations, HTTP Basic, API keys in URLs, http servers, guessable ids and missing limits. Runs in your browser.

Kubernetes Manifest Security Analyzer

Check Kubernetes manifests for privileged containers, root users, host mounts, the Docker socket, latest tags, wildcard RBAC and exposed services. Runs in your browser.

Files

2

File Checksum Verifier

Calculate MD5, SHA-1, SHA-256, SHA-512 and more for any file, even very large ones, and check it against the published checksum.

File Type Identifier

Find out what a file really is from its first bytes, and see whether its name tells the truth.

Your browser

1

Browser Fingerprint Audit

See what any website can read about your browser — user agent, screen, GPU, fonts, canvas — without asking.

Validators & utilities

14

Disposable Email Detector

Check whether an email address or domain belongs to a disposable (temporary) email service.

MITRE ATT&CK Technique Lookup

Search the MITRE ATT&CK Enterprise techniques by ID, name or keyword, and filter by tactic.

IBAN Validator

Check IBANs: country, length, account format and the mod-97 check digits.

IOC Defanger, Refanger & Extractor

Defang URLs, domains, IPs and emails so they are safe to share, restore them, or extract indicators from a report.

Credit Card Validator

Check a card number with the Luhn algorithm and identify the likely brand. Format check only.

Email Header Decoder

Parse raw email headers into key fields and a list of Received hops.

IDN/Punycode Phishing Detector

Identify domain homograph attacks using Punycode and Unicode characters.

Google Dorking Assistant

Build Google search queries with advanced operators for research and authorized testing.

SSH Config Generator

Generate an OpenSSH client Host block for your ~/.ssh/config.

Shodan Query Builder

Build a Shodan search from filters: port, org, net, product, http.title, certificate fields and more, with validation and a ready link.

FOFA Query Builder

Build a FOFA search from fields (domain, title, header, cert, icon_hash, port and more) with =, ==, != and wildcard operators.

GitHub Dork Builder

Build GitHub code-search queries for leaked secrets, .env files, private keys and internal host names in an organisation you own.

Favicon Hash Calculator

Compute the favicon hash used by Shodan (http.favicon.hash) and FOFA (icon_hash) from an icon file, with ready search queries.

PowerShell Command Decoder

Decode PowerShell -EncodedCommand, embedded Base64, compressed payloads and common string obfuscation, then flag what the script does.

More

2

DNS Zone File Analyzer

Parse a BIND zone file and check it: CNAME conflicts, missing glue, trailing-dot mistakes, SPF, DMARC and DKIM, DNSSEC records and takeover-prone aliases. Runs in your browser.

UUID, ULID & Nano ID Generator

Generate UUID v4, UUID v7, ULID and Nano ID values in bulk, in your browser.

Related collections

All collections →
Website audit toolkitPrivacy & security toolsDeveloper essentialsDomain & DNS toolkit