Security & privacy tools
Four tools for the moments when security is a practical question: you need a password for a new account, you have to send a credential to a colleague, you want to keep a recovery code inside an ordinary note, or you have downloaded an installer and want to know it is the real thing.
Security tools have to earn trust, so here is exactly what each one does with your data. Three of the four send nothing anywhere: what you type or drop in is processed in the page. The fourth, One-Time Link, has to store something for the recipient to collect — so it encrypts your secret in your browser first and uploads only the scrambled result. The key stays in the part of the link after the #, which browsers do not send to servers.
All tools 4
Which tool for which job
- Create a strong password or a passphraseThe Password Generator makes random passwords of 6 to 64 characters or passphrases of 2 to 8 words, and shows the strength of each in bits of entropy.
- Send a password, API key or file to someoneOne-Time Link encrypts text or a file of up to 3 MB and gives you a link that stops working after it has been opened once.
- Keep a secret inside a note, a document or a repositoryThe Text Encryptor locks text with a passphrase using AES-256. The result is a block of text you can store or send anywhere.
- Check that a download is genuineThe File Checksum tool computes MD5, SHA-1, SHA-256 and SHA-512 for any file. Paste the publisher's hash and it is compared against all four.
Limits worth knowing
- Length beats cleverness. The default four-word passphrase is rated Fair, at about 42 bits. For anything important, use six to eight words or a 16-character random password.
- The password tool generates; it does not check. You cannot paste an existing password in to have it scored.
- Encrypted text cannot be recovered without the passphrase. There is no reset link and no copy on a server. Losing the passphrase means losing the text.
- A one-time link is used up by pressing Reveal, not by loading the page — so link previews in chat apps do not destroy it. Do not open your own link to test it, and note that a link cannot be revoked or extended once made.
- Unopened links expire after 1, 7 or 30 days, as you choose. Links to files always expire after one day.
- A matching checksum proves the file is intact, and only against the value you compared it with. If an attacker controls the download page they can change the file and the published hash together, so when it matters, get the expected hash from a second source.
How these tools work
All four are built on the Web Crypto API that ships inside every modern browser. Random values come from crypto.getRandomValues, never Math.random, and are sampled so that no character or word is favoured. Encryption is AES-256-GCM, an authenticated mode: if a single character of the encrypted text is altered, decryption fails loudly instead of producing garbage. The text encryptor stretches your passphrase with 200,000 rounds of PBKDF2, which makes guessing slow. One-Time Link keeps its encrypted data in a database with an expiry and reads it back with a single read-and-delete operation, so a link cannot be opened twice.
Guides: What makes a password strong? Entropy, length and passphrases · How to share a password or secret safely · Checksums: how to verify a downloaded file is genuine · Why Toolkit runs entirely in your browser (and why that matters)
From the blog: Backing up your digital life properly: the 3-2-1 rule in practice
More on Toolkit: Image, media & file tools · Text & writing tools · Developer & data tools · Network & web tools · Calculators · Time & everyday tools · Games
Frequently asked questions
Can Toolkit read the secrets I share with One-Time Link?
No. Your secret is encrypted in your browser before anything is uploaded, and the server stores only the encrypted result. The decryption key is carried in the part of the link after the # symbol, which browsers never send to a server.
Are generated passwords stored or logged?
No. Passwords are generated in your browser from its secure random source and are never transmitted, logged or saved. When you close the tab they are gone unless you copied them.
What happens if I forget the passphrase for text I encrypted?
The text cannot be recovered. The encryption has no back door and nothing is kept on a server, so the passphrase is the only way in. Store it as carefully as the secret it protects.
Does a matching checksum mean a file is safe?
It means the file is identical, byte for byte, to the one that produced the hash you compared against. That rules out corruption and tampering in transit. It does not tell you whether the original file was trustworthy in the first place.
Which is stronger, a random password or a passphrase?
Character for character, a random password is stronger: 16 random characters drawn from letters, digits and symbols give about 103 bits of entropy. A passphrase gives about 8 bits per word, so it needs to be long, but it is far easier to remember and type.