All tools
One-Time Secret
Share a password or note through a link that destroys itself after a single view. The text is encrypted in your browser and the key lives in the URL fragment, which browsers never send to a server.
Why we cannot read it: your browser generates an AES-256 key, encrypts the text, and puts the key in the part of the URL after the
#. Browsers never send that part to a server. We store ciphertext and an IV, and delete both the moment the link is opened.More tools
All 16JWT Decoder & Verifier
Decode a JSON Web Token to inspect header and payload, check expiry, and verify the signature (HS* with a secret, RS*/ES* with a public key). Decoding stays in your browser.
Password Breach Checker
Check if a password appears in a known data breach - privately. Hashed in your browser, only a five-character prefix is sent (k-anonymity).
Email Validator
Check an email address: valid syntax, a live MX-record lookup to see if the domain accepts mail, and disposable or role-based flags.