Codxing

Security Hub

Passwords, checksums and encryption — all done with the browser’s own crypto.

Password GeneratorRandom passwords with an entropy and crack-time readout.Passphrase GeneratorWord-based passwords you can actually remember.Password StrengthTest a password for length, patterns and dictionary words.File ChecksumSHA hashes for any file, and compare against a published one.Encrypted NoteAES-256 encrypt a note with a passphrase, and decrypt it back.

About the Security Hub

Generating a password on a website requires trusting that site completely — it could log everything it hands out. The Security Hub sidesteps the question: there is no server, so there is nothing to log to. Passwords come from crypto.getRandomValues, the browser’s cryptographically secure random source, and the encrypted-note tool uses AES-256-GCM with a key derived by PBKDF2 at 250,000 iterations. All of it is the Web Crypto API built into your browser, not a library someone wrote.

Questions

How do I know the passwords are really random?

They come from crypto.getRandomValues, the same source browsers use for TLS key material — not Math.random, which is predictable and unsuitable. The source is visible in devtools if you want to check.

What makes a password strong?

Length, overwhelmingly. A 20-character password of only lowercase letters is far stronger than an 8-character one stuffed with symbols. Aim for 16+ characters, unique per site, stored in a password manager.

Can I recover an encrypted note if I forget the passphrase?

No. There is no recovery, no reset and no backdoor — that is what makes the encryption meaningful. Lose the passphrase and the note is permanently unreadable.

Should I hash passwords with the Hash Generator before storing them?

No. A plain SHA hash is the wrong tool for password storage — it is too fast, so attackers can try billions per second. Use bcrypt, scrypt or Argon2 on your server.