Home › Privacy & Security Tools

Privacy & Security Tools

Generate strong passwords, strip hidden data from your photos, verify files, and make QR codes — all in your browser, nothing uploaded.

Got a text or email you are not sure about? The Scam Message Checker points out its warning signs in plain words, takes every link apart, and tells you what to do next.

Sanitize before sharing

Drop a photo or PDF, see what private information is hiding inside it, and get a cleaned copy — checked again afterwards. Read the guide →

  1. Input
  2. Configure
  3. Export
Files stay on this device

Drop a JPG, PNG or PDF here, or click to choose

Inspected and cleaned entirely on your device

What this does and doesn't claim. It checks the things listed above and reports exactly what it found and what it removed — it never tells you a file is "safe", because no tool can know that. Things it does not address: anything visible in the picture or on the page (a face, a street sign, a name in a letterhead), information inside embedded images, or the contents of the document itself. For blacking out visible text in a PDF, use the redaction tool instead.

File inspector

See what a file tells the world about itself — its browser-visible properties, plus embedded metadata for the formats we can read.

  1. Input
  2. Configure
  3. Export
Files stay on this device

Drop any file here, or click to choose

Nothing is uploaded — the file is read in your browser

A browser can only see what the file itself carries plus what the operating system hands over when you pick it — filename, type, size and last-modified date. It cannot read filesystem-level details such as the original creation date, ownership or where the file has been. For JPEG, PNG and PDF we also parse the metadata embedded inside the file.

Office document metadata cleaner

Word, Excel and PowerPoint files record who wrote them, who edited them, and how long it took. See what's in yours and strip it.

  1. Input
  2. Configure
  3. Export
Files stay on this device

Drop a .docx, .xlsx or .pptx here, or click to choose

Unpacked and rewritten on your device

What is and isn't removed. These files are ZIP packages of XML. The cleaner removes the standard core, app and custom property parts — author, last modified by, company, manager, revision count, editing time, template — and leaves every other part of the package byte-for-byte untouched, so the document still opens normally. It reports but does not delete tracked changes, comments, hidden sheets and hidden slides: removing those reliably means rewriting document content, which risks corrupting the file. Delete those in the application itself before cleaning.

Password Generator

This tool now has its own page, rebuilt on the shared crypto engine — with the entropy counted from the real number of possibilities rather than estimated, and the cost of each option shown. It reports, for instance, that requiring one of every character type makes a password weaker, and by how much.

Generate a password →

Everything still runs in your browser; the tool simply lives somewhere it can be found and linked to on its own. See all the cryptography tools.

Passphrase Generator

Moved to its own page. It prints the actual size of its word list and the exact bits each word is worth, rather than quoting a figure that belongs to somebody else's list.

Generate a passphrase →

Everything still runs in your browser; the tool simply lives somewhere it can be found and linked to on its own. See all the cryptography tools.

EXIF Metadata Viewer & Remover

Photos often embed hidden data — camera model, date, even GPS location. See what's there and download a clean copy.

  1. Input
  2. Configure
  3. Export
Files stay on this device

Drop a JPG or PNG here, or click to choose

Your photo never leaves your device

File Hash / Checksum Verifier

Split into two pages, because they answer different questions. The hash calculator produces a digest of a file or of text; the checksum verifier compares a file against a digest somebody gave you, and is careful about the ways a pasted digest arrives damaged.

Calculate a hash →   Verify a checksum →

Everything still runs in your browser; the tool simply lives somewhere it can be found and linked to on its own. See all the cryptography tools.

QR Code Generator

Make a QR code for a link, Wi-Fi network, contact card, email, phone or text message — encoded directly, with no tracking redirect.

What's encoded in this QR code?

Anyone who scans the code can read everything encoded in it — including a Wi-Fi password or contact details. The data is written straight into the QR pattern on your device; no shortener or tracking redirect is involved.

Encrypt / decrypt a file

This tool now lives on its own page, rebuilt on the shared crypto engine.

The version that used to sit here wrote an older container format with two problems worth naming. Its header was not covered by the authentication tag, so the recorded key-derivation count could be altered — not enough to reveal anything, but enough to make a correct passphrase look wrong. And it always saved the result as <original>.tfenc, which left the original filename in plain view on disk while the page said the name was inside the encrypted payload. It was, and it also was not.

Encrypt a file →   The new page uses the same primitives — AES-256-GCM, PBKDF2-HMAC-SHA-256 at 600,000 rounds, fresh salt and nonce — with the header authenticated and the filename an explicit choice. Files encrypted with the old version still open there, and will continue to.

See also text encryption for a message you can paste, and all the cryptography tools.

Why do this in your browser?

Passwords, personal photos, and files are exactly the kind of thing you should never paste or upload to a random website. Every tool here runs locally: passwords come from your device's cryptographic random generator, EXIF stripping and hashing happen in memory on your machine, and nothing is ever transmitted. Close the tab and it's gone.