Skip to main content

Security

Security tools that never leak your secrets

The hub for SnapToolz' privacy and security tools — the place to pick the right one for the job at hand, whether that's a fresh password for a new account, an encrypted note you need to send, or a suspicious QR code you want to vet before scanning. Every tool generates and processes entirely in your browser, so the secret you're protecting never enters anyone's log or database.

  • No uploads — files stay on your device
  • WebAssembly fast
  • Works offline
  • 100% free, no sign-up

6 tools in Security

Browse all categories
Password GeneratorNew

Cryptographically-strong passwords + strength checker.

Random TokenNew

Generate UUIDs, API keys, and random strings.

AES EncryptionNew

Encrypt and decrypt text with AES-256-GCM. Passphrase only.

Password Strength VisualizerNew

Audit any password — entropy, character classes, time-to-crack at 5 attack rates.

Browser Permission CheckerNew

See which permissions your browser allows and detect supported APIs — WebGPU, Workers, more.

QR Code InspectorNew

Scan a QR image and analyse its payload for phishing red flags — Punycode, shorteners, mixed scripts.

Go deeper · Learning Center

Privacy & security in practice — encryption, passwords and metadata

Start here: which security tool for which job

Every tool here generates and processes locally, so no secret ever reaches a server that could log it. Pick by what you're protecting, then follow the link:

You want toUseNote
Create a strong, unique passwordPassword GeneratorDraws from the browser CSPRNG
Check how strong a password isPassword StrengthPenalises patterns, not just length
Make a file unreadable without a keyAES EncryptionAES-256-GCM, authenticated
Generate an API key or random tokenToken Generator128+ bits of real entropy
Check a QR code before scanning itQR InspectorCatches phishing payloads
See what a site is allowed to accessPermissions InspectorCamera, mic, location, notifications

Who this hub is for, and where to begin

People setting up a new account who don't want to reuse an old password, anyone who needs to send a file or note that shouldn't be readable in transit, developers minting API keys, and cautious folks who'd rather inspect a QR code than trust it — this is the starting point for all of them. The everyday risks these address (reused passwords, leaked metadata, phishing) are far more common than exotic attacks, and every tool here runs with no network call.

Where to begin depends on the task: generate a unique password per site and sanity-check it with the strength meter; encrypt anything that must travel with AES; and treat an unknown QR code like an unknown link. The reasoning behind each choice is laid out in the Privacy & Security Learning Center hub.

Frequently asked questions

  • Is the random number generator cryptographically secure?

    Yes — `crypto.getRandomValues` is a CSPRNG mandated by the Web Crypto specification. It's safe for password generation, key material, and security tokens.

  • How is AES encryption implemented?

    We use Web Crypto's AES-256-GCM with a key derived from your passphrase via PBKDF2-SHA256 (600,000 iterations + 16-byte random salt + random IV). The encrypted output bundles a version marker, salt, IV, and ciphertext together, and ciphertexts made with the earlier 200,000-round format still decrypt.

  • Why generate passwords or hashes locally rather than on a server?

    Any string you generate on a server is technically observable by that server (in logs, in transit, in caches). For a low-stakes password (a guest Wi-Fi code) the risk is academic. For high-value passwords — your master password, cryptocurrency seed phrases, recovery keys, encryption passphrases — local generation is the entire point of the exercise. SnapToolz' security tools run with no network call, so the secrets exist only on your device until you copy them into your password manager.

  • Can I trust browser-side encryption with sensitive data?

    The Web Crypto API is the same primitive that secures HTTPS, JWT signing, and credential storage in every modern browser. AES-256-GCM at 200k PBKDF2 iterations is the same standard used by enterprise password managers. The harder question is what happens to the ciphertext after — write it to a secure place yourself; the encryption is only as strong as where you store the result.

  • Are my files uploaded anywhere?

    No. Every SnapToolz tool runs entirely in your browser using JavaScript and WebAssembly. Files are read locally, processed in memory, and the result is offered as a download. There is no backend.

  • Is everything free?

    Yes — every tool in this category and on the entire site is free with no sign-up, no daily limit, and no watermark.

Learn more about SnapToolz