Thirteen utilities that never phone home.
Nothing you type leaves your browser. Where it makes sense a tool encodes its inputs in the URL, so a link is the whole working, and one button copies it into a thread, a war room, or a procurement email.
Risk assessment calculator
Likelihood times impact with control effectiveness, a residual score, and a small register you can build up and share.
Vendor TCO calculator
Three or five year total cost for two vendors side by side, including the internal effort the quote leaves out.
Security maturity self-assessment
Twenty-four statements across six domains. Ten minutes, a level per domain, and what to fix first.
CVSS 3.1 calculator
Score a vulnerability on the official base metrics and get the vector string to paste into a ticket.
CIDR and subnet calculator
Network, broadcast, usable range and host count for any IPv4 prefix, plus what splitting it costs you.
Passphrase and password generator
Diceware passphrases and random strings, with the entropy shown honestly in bits and in time to crack.
Hash generator and comparer
SHA-256, SHA-1, SHA-512 for text or a whole file, computed in your browser, with a constant-time compare.
Encoder and decoder
Base64, URL, hex, HTML entities and Unicode escapes, both directions, with the chain shown at each step.
JWT decoder
Read the header and claims of a token, check the expiry, and see what it discloses. Nothing is sent anywhere.
Suspicious URL inspector
Punycode, homoglyphs, lookalike domains, shorteners, credentials in the authority and other tells, explained.
security.txt generator
A valid RFC 9116 file for your domain, so a researcher who finds something knows where to send it.
SPF and DMARC record builder
Build the DNS records, understand what each tag does, and get a rollout order that will not break your mail.
Breach notification clock
When each regulator expects to hear from you, counted from the hour you became aware.
Why they work like this
Every calculation here happens in the tab you are reading. There is no upload, no account requirement, and no server-side log of what you typed, which is the only honest way to offer a hash checker or a JWT decoder to people who handle other organisations' incidents.
Icons are inline, the script is one small file served from this domain, and no tool loads anything from a third party. They work on a locked-down corporate network and they work offline once the page is open.
Like, subscribe, share
A like tells us which tools are worth sharpening. A subscription puts the tool on your dashboard and means you hear when it changes. Sharing is one click: the native share sheet on a phone, the clipboard everywhere else.
Shares are deliberately not counted. A share happens in your browser and telling us about it would break the promise the rest of the page makes.
Want a tool added? Propose it in General.