Content Security Policy Evaluator - Online Hash & Nonce Check
Test if a script or style will be allowed by a given CSP. Compute hash/nonce. Strengthen your site’s defense against XSS. Local.
UD5 Toolkit
Generate short, unique, non-sequential IDs from numbers, or decode them back.
Hashid is a small library that generates short, unique, non-sequential IDs from positive integers. It’s often used to hide real database IDs in URLs or for creating friendly public identifiers.
No, Hashids is not encryption. It’s an obfuscation technique. Anyone with the salt (and alphabet) can decode the IDs. Do not use it as a security measure.
No. Without the exact salt and alphabet used during encoding, decoding will either fail or return wrong numbers. Always store your salt securely.
The salt shuffles the character mapping, and minimum length pads the output. Even a tiny change in either parameter produces a completely different hashid.
Only positive integers (0, 1, 2, …) and arrays of positive integers. Negative numbers and floats are not supported.
Test if a script or style will be allowed by a given CSP. Compute hash/nonce. Strengthen your site’s defense against XSS. Local.
Enter a router's MAC address or serial and generate the common default WPA passphrase for major ISP brands. Educational purpose only.
Display your effective connection type (4g, 3g, etc.) and downlink speed using the Navigator API. Adapt your app accordingly.
Generate a Contributor Covenant or custom Code of Conduct for your project or event. Ready to paste into your repo.
Paste the Permissions‑Policy header and get a human‑readable table of allowed/blocked browser features. Understand how your site is restricted.
Tell if your password has appeared in data breaches without sending the full password. Uses hash prefix locally.
Validate a DNSSEC chain by entering DS and RRSIG records. Verify that signatures match. Educational. Local algorithm.
Enter a domain and see its SSL certificate details: issuer, validity dates, and chain. Client‑side fetch.
Enter a website and check which security headers (HSTS, CSP, X‑Frame‑Options) are present. Get a security grade.
Define minimum length, uppercase, digits, special chars, and check if a password meets your custom policy. Instant feedback.
Tell the tool what base liquor and mixers you have, and it suggests classic cocktails. Simple database. Cheers!
Paste an enciphered text and instantly see all 25 possible shifts. Highlight the most plausible.
Encode or decode data to/from Base58 (Bitcoin alphabet). Useful for cryptocurrency address generation testing. Fully local, no data sent.
Encode or decode a string for use in a URL query parameter. See the raw and encoded versions. Dev tool.
Paste text with \uXXXX or \xXX escape sequences and decode to readable characters. Works for all Unicode planes.
Decode an image progressively using the ImageDecoder API. See partial results and metadata. Modern alternative to <img>.
Encode latitude/longitude into a geohash string and decode a geohash back to coordinates with precision info. Local algorithm.
Encode any file into a Base64 string that you can copy, or decode a Base64 string back to a downloadable file. Pure frontend.
Convert your text into a string of emojis using a simple substitution cipher. Share secret messages that look fun. Decode them with the same tool. All local.
Paste a JSON Web Token and decode its header and payload. Verify signature if you provide the secret. Fully local.
Hide your email address from scrapers by encoding it using HTML entities and CSS tricks. Still clickable for real users. Local generator.
Freeze your live camera, then scan a QR code from the static frame. Works when auto‑scan fails. Private.
Instantly convert plain text into HTML‑safe escaped characters for secure display in web pages. Prevent cross‑site scripting. All processing local.
Paste a data: URL and instantly download the file it represents. Supports all MIME types. Simple extraction.
Enter Braille dot numbers (1‑6) or paste Unicode Braille to decode into English text. Companion to text‑to‑Braille.
Paste a raw cookie string and see a formatted key‑value table. Debug session cookies and understand flags. Runs in browser.
Upload an image containing a QR code and decode its content. Works offline using JavaScript QR decoder. No camera needed.
Find out the real destination of any shortened link (bit.ly, t.co, etc.) without clicking. Resolves redirects locally using public HTTP headers.
Escape HTML special characters to prevent XSS attacks, or unescape HTML entities back to original text. Essential for web developers. Runs locally.
Break down any URL into its individual components: protocol, hostname, path, query parameters. Decode query strings easily. Purely client-side.