Security & Privacy

Security tools that run in your browser

Security utilities are different from ordinary converters because the input is often sensitive: a password you are auditing, an API secret, a private key, a JWT payload, a TOTP seed or the file you want to fingerprint. The tools in this collection are designed for local, browser-based workflows. They use JavaScript and browser crypto APIs where possible, which means you can check, generate or transform security data without handing it to a server-side service.

Choose the right tool for the security job

Use the password generator when you need a new random credential, and the password strength checker or password entropy calculator when you need to evaluate an existing password or passphrase. Use the security hash generator to calculate SHA checksums for text or files, and the PBKDF2 hash generator when you need password-based key derivation rather than a plain checksum.

For authentication and API debugging, the HMAC generator signs messages with a shared secret, the Basic Auth header generator builds the exact HTTP header value expected by older APIs, and the JWT decoder lets you inspect token claims before you trust them. For key material, the RSA key generator creates key pairs locally, while the AES encrypt/decrypt tool handles symmetric encryption using AES-GCM.

Practical privacy model

ZeroUtil security tools are built for quick checks and developer operations, not as a replacement for a password manager, hardware security key, vault, or production key-management system. They are most useful when you need transparent client-side behavior: verify a downloaded file hash, generate a throwaway token for a local script, inspect a test JWT, calculate a TOTP code from a saved secret, or explain why a password is weak. For production secrets, keep your source of truth in a dedicated vault and rotate anything that may have been exposed elsewhere.

Common security workflows

• Password review - compare length, character set, entropy and obvious pattern risks before updating old credentials.
• Hash and checksum verification - calculate SHA-256 or SHA-512 for downloads, release artifacts or text snippets.
• API authentication - build Basic Auth headers or HMAC signatures for debugging requests against private services.
• Token inspection - decode JWT headers and claims locally so you can check expiry, issuer and audience fields.
• Key and code generation - create RSA key pairs, random tokens and TOTP codes without server-side storage.