Skip to content
wowTools

Password and Hash Tools

Generate strong passwords, check strength, and compute SHA and HMAC digests locally with Web Crypto.

Introduction

Secrets should not travel to a website to be generated or hashed. These tools use the browser's Web Crypto APIs to create random passwords and strings, estimate the strength of a candidate secret, compute SHA-256 and SHA-512 digests for text or files, and sign payloads with HMAC—so the values you experiment with never leave the tab you opened.

Featured tools

Password Generator

Secure local password generator with strength meter.

  • password
  • security
  • random
  • generator

Password Strength Checker

Local entropy and checklist-based password strength check.

  • password
  • security
  • strength
  • entropy

Hash Generator

SHA-256/512 hashing for text and files via Web Crypto.

  • hash
  • sha256
  • sha512
  • checksum

HMAC Generator

HMAC-SHA256/384/512 signing via Web Crypto.

  • hmac
  • sha256
  • webhook
  • signature

Random String Generator

Generate random strings with custom character sets.

  • random
  • string
  • generator
  • token

UUID Generator

Generate UUID v4 and v7 IDs locally with bulk output.

  • uuid
  • guid
  • random
  • generator

AES Encrypt/Decrypt

Password-based AES-256-GCM demo via Web Crypto.

  • aes
  • encryption
  • pbkdf2
  • crypto

Categories

Collections

Security Helpers

Inspect JWTs, generate hashes and passwords, and encode payloads locally before they leave your machine.

9 tools

Learn more

Frequently asked questions

Are generated passwords safe to use?
They are produced from the browser's cryptographic random source, not a predictable pseudorandom generator. Copy them straight into a password manager and clear the workspace on shared devices.
Can I hash a password with SHA-256 for storage?
No. Fast hashes are the wrong tool for credentials. Server-side password storage needs a slow, salted algorithm such as Argon2 or bcrypt.
What is the difference between a hash and an HMAC?
A hash proves bytes did not change; an HMAC proves someone holding a shared secret produced them. Webhook verification needs the HMAC.
How long should a password be?
Sixteen or more random characters is a comfortable default when a manager stores it. Length raises entropy faster than adding symbol requirements.
Is the encryption tool suitable for production secrets?
No. It demonstrates password-based AES-GCM for learning. Real systems need managed keys, rotation, and audit trails outside a browser tab.