4 tools CRYPTO
Compute message digests, generate hardened passwords, and construct Content-Security-Policy headers entirely in your browser. Hashing and generation happen locally, so secrets, passwords, and headers your pipeline relies on never transit any server.
Master workflows, understand protocol specifications, and avoid production edge-cases.
Master .env formatting rules, resolve multiline string and certificate escaping bugs, manage .env precedence, and prevent secret leaks in CI/CD.
Master Content Security Policy (CSP) headers, nonce generation, sha256 script hashing, Report-Only mode, and debugging modern Next.js and SPA violations.
Master cryptographic hashing: evaluate collision resistance, benchmark SHA-2 vs SHA-3 vs BLAKE2, prevent length extension attacks with HMAC, and safely verify file checksums.
A production debugging guide to fixing missing origin headers, failed preflight OPTIONS requests, credentialed CORS mismatches, and reverse-proxy proxy pass drops.
A comprehensive developer debugging guide to resolving JSON Web Token (JWT) errors: signature mismatches, expired tokens, alg: none attacks, clock skew, and JWKS key rotation.
Master HTML entity encoding, numeric character references, context-aware XSS escaping in body vs attributes vs JS, and HTML5 named entity parser rules.
A comprehensive developer guide to positional numeral systems, arbitrary-precision BigInt radix conversions, two's complement signed arithmetic, and IEEE 754 float inspection.
Implement bulletproof browser cookie security with SameSite=Lax/Strict, enforce host binding via __Host- and __Secure- prefixes, prevent CSRF attacks, and configure CHIPS for cross-site embeds.
Benchmark memory-hard Argon2id against bcrypt and PBKDF2, configure work factors for modern GPU resistance, avoid the 72-byte bcrypt truncation trap, and implement seamless on-login hash upgrades.
A developer security guide to identifying direct, indirect, and multi-turn prompt injection vulnerabilities in LLM applications and agent pipelines.
A developer guide to Protocol Buffers wire format, decoding varints, resolving tag mismatches, and debugging corrupt binary gRPC and Kafka streams.
Master X.509 certificate decoding, debug missing intermediate CA chains, fix SSL_ERROR_UNTRUSTED_ISSUER, configure DNS CAA records, and verify TLS 1.3 setups.
Compare RFC 9562 UUIDv7, ULID, and UUIDv4 for database primary keys. Understand B-tree index fragmentation, sortability, and storage efficiency in PostgreSQL and MySQL.
Master webhook security: implement HMAC-SHA256 signature verification, prevent replay attacks with timestamp headers, avoid raw-body parser bugs, and secure asynchronous API callbacks.
Yes, all security & crypto tools are free and run entirely in your browser with no usage limits and no account required.
Yes. Hash and password generation happen client-side using the Web Crypto API — your input never leaves your device.
The CSP builder helps you construct a Content-Security-Policy header that restricts which domains a page may load scripts and styles from, blocking XSS attacks before the browser can fetch them.