Tools for Security Professionals
Security engineers, pen testers, and CTF players constantly need to encrypt data, generate hashes, decode encoded payloads, and analyse tokens. These Tools.Fun utilities cover the most common browser-based security tasks. All cryptographic operations run entirely client-side — no data is sent to any server.
AES Encryptor / Decryptor
Encrypt and decrypt text using AES-256-CBC with a passphrase. Use it to test symmetric encryption implementations, verify cipher outputs, and quickly protect sensitive text snippets. Supports both encryption and decryption so you can round-trip test your keys.
RSA Encryptor / Decryptor
Encrypt data with an RSA public key or decrypt with a private key — fully in the browser. Ideal for testing PKI implementations, verifying key pairs, and understanding padding schemes (PKCS#1, OAEP). Useful during pen tests that involve certificate-based authentication.
DES Encryptor / Decryptor
DES is a legacy cipher still present in older enterprise systems and some embedded devices. Use this tool to analyse DES-encrypted payloads and demonstrate to stakeholders why DES is cryptographically broken by modern standards.
MD5 / Hash Generator
Generate MD5, SHA-1, SHA-256, and SHA-512 hashes from any input string. Core use cases in security work include verifying file integrity against published checksums, comparing stored vs. computed hashes, generating expected HMAC values for API signature debugging, and demonstrating hash collision vulnerabilities in MD5 and SHA-1.
Password Generator
Generate strong random passwords with full control over length, character classes (uppercase, lowercase, digits, symbols), and entropy estimation. Use during pen tests for creating test credentials, for demonstrating the difference between weak and strong passwords to clients, and for generating API keys and shared secrets.
Base64 Encoder / Decoder
Decode Base64-encoded tokens, JWTs, API keys, and Kubernetes secrets. Encoding in Base64 is a common obfuscation technique found in malware, phishing payloads, and injected scripts — this tool strips it away instantly. Also encode payloads for use in injection testing.
URL Encoder / Decoder
Decode percent-encoded payloads frequently used in XSS, SQL injection, and path traversal attack strings. Encode payloads to test input validation filter bypasses. Essential for manual web application testing.
Hex Converter
Convert shellcode, byte sequences, and memory addresses between hexadecimal, decimal, and binary. Useful when analysing binary exploits, reverse engineering, and working with raw network packet data.
Unicode Converter
Convert between Unicode code points and characters to detect and construct Unicode homoglyph attacks — where visually similar characters (е vs e) are used to bypass filters or spoof domain names (IDN homograph attacks).
RegExp Tester
Test input sanitisation and validation patterns in real time to identify bypass opportunities. Verify that your WAF regex rules match the expected attack patterns and don't have blind spots.
Code Diff Tool
Compare two versions of a script, config file, or binary dump side by side to spot unauthorised changes, backdoors, or injected code. Useful in incident response when auditing modified files.
IP Lookup
Geolocate IP addresses during reconnaissance, incident triage, and threat intelligence work. Identify the ASN, hosting provider, and organisation behind a suspicious IP found in logs or OSINT.
User-Agent Parser
Analyse User-Agent strings from web server logs to identify bots, crawlers, and suspicious automated tools. Useful during log analysis in web application penetration tests.
JSON Formatter
Pretty-print JSON payloads captured from API traffic, JWT headers, and OAuth responses to analyse their structure during API security assessments.
Timestamp Converter
Convert Unix timestamps found in log files, JWTs (iat, exp claims), and session tokens to human-readable dates to verify expiry and issuance times during token analysis.
Crontab Calculator
Analyse scheduled task expressions found during post-exploitation or configuration audits. Understand exactly when a persistence mechanism or data exfiltration job is scheduled to run.
cURL Converter
Convert captured HTTP requests to cURL format for inclusion in security reports and proof-of-concept documentation. Helps clients reproduce findings without needing specialist tools.
← Back