METHOD BEFORE OUTPUT
Cryptography tools should state what protection they actually provide
Choose a tool by the protection question you need to answer. Create a password or TOTP code, encrypt a short message, generate a key or signature, compare a hash, inspect a JWT, study a classical cipher, or read an older format. The labels keep encoding, hashing, encryption, signing, and verification separate so a reversible conversion is not mistaken for protection.
Passwords, private keys, TOTP seeds, plaintext, ciphertext, and results stay in the current browser tab during ordinary use. The pages show important choices such as algorithm, key size, encoding, padding, and compatibility mode. Clear sensitive fields when you finish, and use an organization’s approved key-management process for production credentials.
Modern protection needs authentication
The AES page uses AES-256-GCM, a fresh 96-bit IV, and a password-derived key with a fresh salt. GCM authenticates the encrypted text, so a wrong password or modified envelope fails instead of producing plausible garbage. The RSA page separates OAEP encryption from PSS signatures and limits the operation to short text because RSA is normally used to protect small session material rather than whole files.
TOTP seeds and private keys can grant access to real systems. The interface therefore treats them as secrets, never saves them as tool history, and gives visitors a clear reminder to clear the tab. Browser-generated keys are useful for testing and learning, but they are not certificates or substitutes for an organization's key-management process.
Hashes, MACs, and checksums answer different questions
SHA, Keccak, SHAKE, MD5, and RIPEMD-160 create deterministic digests. HMAC additionally uses a shared secret to authenticate a message. CRC-32 is designed to catch common accidental changes, not hostile tampering. MD5 and SHA-1 remain visible only where old formats require them, with a warning that their collision resistance is inadequate for modern signatures or security decisions.
Password storage is another separate problem. Fast general hashes are poor password verifiers because attackers can evaluate them cheaply. The htpasswd page defaults to bcrypt, while its SHA-1 output is explicitly marked as legacy compatibility. The password strength page estimates guess patterns but cannot know whether a password has been privately reused, stolen, or exposed by malware.
Older ciphers need a clear warning
Caesar, Vigenère, Hill, Rail Fence, ROT, repeating-key XOR, symbol substitution, and zero-width steganography are useful for lessons, puzzles, and reversible demonstrations. Their rules are public and their patterns are easy to recover. Rabbit, RC4, DES, and Triple DES are available when an old format must be read, but new private data belongs in a current authenticated design such as AES-GCM.
Code packing and obfuscation can slow casual reading but cannot hide an API key shipped to a browser. The JavaScript decoder and unpacker accept only wrappers generated by this site and do not execute submitted source. Visitors should still review transformed code, restrict work to code they own, and use ordinary access control for genuine secrets.