Free online privacy and security tools
Password generators, hash tools, metadata strippers, and privacy-focused utilities.
Five tools built around the browser's own WebCrypto implementation, which is the part of this hub that matters: the cryptographic primitives are the ones your browser vendor ships and audits, not JavaScript reimplementations, and the plaintext never leaves the tab. File Encrypt derives a key from your password with PBKDF2-SHA256 at 600,000 iterations — the OWASP figure for that combination — using a fresh 16-byte random salt, then encrypts with AES-256-GCM under a 12-byte random IV. The result is written into a small container that records the format tag, the version, the iteration count used, the salt, the IV and the original filename, so a file encrypted today still decrypts if that iteration count is raised later, and so the original name is restored on the way back out. GCM is authenticated, so a corrupted or tampered file fails to decrypt rather than producing garbage. Text Encrypt does the same to a string and hands you Base64 you can paste into a message. Steganography hides text inside the least significant bit of each pixel's red, green and blue channels, skipping alpha, which changes any channel by at most one part in 256; the tool reports the exact capacity of your image, floor of width times height times three, minus a 32-bit length header, divided by eight bytes, and requires PNG output because JPEG re-compression destroys the modified bits. Its password option encrypts the text with the same AES-256-GCM and 600,000-iteration PBKDF2 before embedding, so anyone reading the raw bits finds ciphertext. Checksum Verify covers the other half of file security, integrity rather than secrecy: paste the checksum a publisher printed next to a download and it identifies the algorithm from the digest length — 32 hex characters for MD5, 40 for SHA-1, 64 for SHA-256, 128 for SHA-512 — hashes your file and tells you whether they match. MD5 is computed with the SparkMD5 library because WebCrypto deliberately omits it, while the SHA digests come from crypto.subtle. The Privacy Policy Generator is the odd one out, a drafting tool rather than a cryptographic one, building a policy from GDPR, UK GDPR, CCPA or general US templates with industry presets and ten toggleable sections, exportable as text, Markdown or HTML.
5 tools · always free · no account needed
File Encrypt
AES-256 file encryption and decryption
Text Encrypt
Encrypt and decrypt text messages
Steganography
Hide secret text inside images
Checksum Verify
Verify file integrity against expected hash
Privacy Policy Generator
Generate GDPR-compliant privacy policy
How to choose the right tool
Match the tool to what you are protecting against. If someone might read the file, use File Encrypt: it produces an encrypted container whose contents are unrecoverable without the password, which is what you want before putting a document in cloud storage or attaching it to an email. If someone might read a short message, Text Encrypt is the same protection without a file, since the Base64 output pastes into any chat window. If the risk is that the file was altered or truncated in transit rather than read, you want Checksum Verify instead of encryption: it takes the published digest and the file and answers yes or no, detecting the algorithm from the checksum itself so you do not have to know whether the publisher used SHA-256 or MD5. Steganography is for concealing that a message exists at all, which is a different goal from keeping it secret; combine it with the password option so it does both. The Privacy Policy Generator is unrelated to the other four and produces a starting draft, not legal advice.
Frequently asked questions
If I lose the password, can the file be recovered?
No, and there is no mechanism that could. The key is derived from your password alone, and no copy of it, of the password, or of the plaintext is stored anywhere. There is no account, no key escrow and no reset. That is the property that makes the encryption meaningful, and it is also the reason to keep the password in a password manager before you encrypt anything you cannot afford to lose. The container stores only the salt, the IV and the iteration count.
Why 600,000 PBKDF2 iterations, and does that make it slow?
Iteration count is deliberate cost: it slows an attacker guessing passwords by the same factor it slows you, and 600,000 for PBKDF2-SHA256 is the current OWASP recommendation. In practice you pay it once per encrypt or decrypt, which is well under a second on a modern machine and a noticeable pause on an older phone. Because the count is written into the file header, files encrypted at an older setting still open correctly after the default is raised.
How much text can I hide in an image?
Capacity is three bits per pixel, since one bit goes into each of the red, green and blue channels and alpha is skipped, minus a 32-bit length header. A 1920x1080 PNG therefore holds about 777 KB of payload, and a small 400x400 avatar about 60 KB. The tool calculates the exact figure for the image you load and refuses anything larger. Encrypting the message first adds the salt, IV and authentication tag, so the ciphertext is somewhat bigger than the text you typed.
Why must the steganography output be PNG?
Because PNG is lossless and JPEG is not. Hiding data in the least significant bit works only if every pixel value survives exactly; JPEG re-encoding transforms blocks of pixels and rounds coefficients, which rewrites precisely the bits the message lives in. The same applies after you export: uploading the PNG to a service that recompresses images, as most social platforms do, will silently destroy the payload. Send the file itself rather than posting it.
Is MD5 still safe to use?
For catching an accidental download error, yes, and that is why Checksum Verify still accepts it alongside the SHA family. For anything adversarial, no: MD5 collisions can be produced cheaply, so a matching MD5 does not prove a file was not deliberately substituted. SHA-1 is in the same position. Use SHA-256 when the checksum is meant as a security guarantee, and treat a publisher who offers only MD5 as giving you an integrity check rather than an authenticity one.
Is the generated privacy policy legally valid?
It is a draft, not legal advice. The generator assembles standard clauses from a GDPR, UK GDPR, CCPA or general US template, adapted by the data types, cookies, analytics and third-party services you declare, across ten sections you can switch on or off. Whether it is accurate depends entirely on whether your declarations match what your product actually does, and several jurisdictions require specifics no template can guess. Have a qualified lawyer review it before publishing.
Collections that include these tools
You might also need
QR generators, URL shorteners, password tools, checksum calculators, and general-purpose utilities.
IP lookups, DNS tools, HTTP header inspection, port scanners, and network diagnostic utilities.
NDA templates, contract generators, legal document summarizers, and business compliance utilities.
Updated