Security Tools

Almost entirely, and where it is not, the page says so. Passwords you generate, text you encrypt and hashes you compute are handled in your browser with JavaScript and the Web Crypto API, and are never sent anywhere. Two tools have to reach the network to do their job, and neither sends your secret: the password breach checker uses the k-anonymity method, sending only the first five characters of your password's SHA-1 hash to Have I Been Pwned so the password itself never leaves your device, and the email security checker looks up public DNS records for the domain you enter. Anything you paste into the other tools stays local, which you can confirm by watching your browser's network tab. These pages also load third-party analytics and advertising scripts, which see the page you are on but not what you type.

The FindUtils password generator uses the Web Crypto API's crypto.getRandomValues() function, which provides cryptographically secure pseudo-random number generation (CSPRNG). This is the same entropy source used by browsers for TLS/SSL connections and is considered secure for generating passwords, tokens, and cryptographic keys. The generator runs locally in your browser with no server communication. You can customize password length from 4 to 128 characters and select character sets including uppercase, lowercase, numbers, and special symbols. The tool also displays real-time password strength analysis using the zxcvbn algorithm, showing estimated crack time and entropy bits for each generated password.

For text, the hash generator computes MD5, SHA-1, SHA-256 and SHA-512 at once, and the hash comparison tool checks a value against MD5, SHA-1, SHA-256, SHA-384 or SHA-512. The HMAC generator signs a message with a secret key using SHA-1, SHA-256, SHA-384 or SHA-512. The file hash calculator reads a file in your browser and gives its MD5, SHA-1, SHA-256 and SHA-512 checksums, which you can compare against a published value to confirm a download was not changed. The SHA family uses the browser's built-in Web Crypto API; MD5, which Web Crypto does not offer, runs in a small JavaScript implementation. Results are shown in hexadecimal. Use MD5 and SHA-1 only for checksums, not for security, and use a slow password hash such as bcrypt or Argon2 to store passwords.

Yes. The FindUtils password breach checker uses the Have I Been Pwned (HIBP) API with a k-anonymity privacy model. When you enter a password to check, the tool computes its SHA-1 hash locally in your browser, then sends only the first 5 characters of the hash prefix to the HIBP API. The API returns all known breached password hashes that share that prefix, and your browser checks locally whether your full hash appears in the returned set. This means your actual password, and even its complete hash, is never transmitted over the network. Have I Been Pwned is a widely used public database of passwords exposed in data breaches. The API path is different: see the tool page for what an API call sends.