Security Tools

When to use these tools

Two distinct jobs live here, and the difference matters. Password and passphrase generation produces secrets, so the security property that counts is where the randomness comes from: these tools draw from the Web Crypto API, which is a cryptographically secure generator, rather than the Math.random function most casual generators use and which is predictable by design. Run these offline, in a private window, and paste the result straight into your password manager rather than into a chat or a notes app. Password Strength Checker is the reverse task: it tells you whether a password you already have would survive a cracking attempt, which is more useful when you are auditing an existing set than when you are creating a new one. The CSP generator builds a Content Security Policy header for your site, and it is the one here worth treating as a starting draft rather than a finished policy — a policy set too tightly breaks your own site in ways that take time to diagnose, so deploy it in report-only mode first and read what it flags. None of this substitutes for a password manager and multi-factor authentication.