Free tools for security, network & DevOps engineers
29 browser-based tools across 5 categories — subnet calculators, hash & JWT utilities, password tools, JSON/YAML helpers and security risk calculators. No sign-up, no data ever leaves your device.
Why ToolSec
Private by design
Every tool runs entirely in your browser with JavaScript. The data you enter — IPs, passwords, tokens, payloads — never touches our servers.
Fast & free
No sign-up, no paywall, no clutter. Pages are statically rendered so they load instantly and even work offline after the first visit.
Built to teach
Each tool comes with a clear explanation and real examples, so you don't just get an answer — you understand why it's correct.
Network & IP
View all →Subnet, CIDR, IPv4/IPv6 and other network calculations for infrastructure engineers and sysadmins.
- Subnet Calculator (IPv4 CIDR) Enter an IP and CIDR to instantly get the netmask, network, broadcast, host range and total number of addresses.
- IPv6 Subnet Calculator Get the network, address range, total count and compressed/expanded form of any IPv6 prefix.
- CIDR ↔ IP Range Converter Expand a CIDR to its address range, or collapse an IP range into minimal CIDR blocks.
Crypto & Encoding
View all →Hash, Base64, JWT, HMAC, URL encode/decode — an encoding & decoding toolkit for developers.
- Base64 Encode / Decode Convert text to Base64 and back, with full Unicode (UTF-8) support.
- URL Encode / Decode Percent-encode text for safe use in URLs, or decode %xx sequences back.
- Hash Generator (MD5, SHA-1, SHA-256, SHA-512) Compute MD5, SHA-1, SHA-256, SHA-384 and SHA-512 digests from any text.
- JWT Decoder & Validator Decode a JWT's header and payload, inspect its claims, and verify an HS256 signature.
- JWT Generator (HS256) Create and sign a JSON Web Token (HS256/384/512) from a payload and secret.
- HMAC Generator (SHA-1, SHA-256, SHA-512) Compute an HMAC from a message and secret key using SHA-1/256/384/512, as hex or Base64.
- Hex ↔ Text Converter Convert text to hexadecimal and decode hex back to text, with UTF-8 support.
Passwords & Secrets
View all →Generate strong passwords, measure entropy, create API keys and manage password policies.
- Password Generator Create strong, random passwords with custom length and character sets — generated securely in your browser.
- Password Strength & Entropy Checker Measure a password's entropy in bits and estimate how long it would take to crack.
- API Key & Secret Generator Generate cryptographically secure API keys and secrets in hex, Base64url or alphanumeric.
- UUID Generator (v4 & v7) Generate random v4 UUIDs or time-ordered v7 UUIDs in bulk, ready to copy.
- Bcrypt Hash Generator & Checker Hash a password with bcrypt at an adjustable cost factor, or verify a password against a hash.
- .htpasswd Generator (bcrypt) Create a secure Apache/nginx basic-auth entry with a bcrypt-hashed password.
Compliance & Risk
View all →Estimate risk costs, GDPR fines and security ROI — calculators for managers and CISOs.
- Data Breach Cost Estimator Estimate the financial impact of a data breach from records exposed and per-record cost.
- GDPR Fine Calculator Estimate the maximum GDPR penalty from annual turnover and infringement tier.
- Ransomware Downtime Cost Calculator Estimate the total impact of a ransomware attack from downtime, recovery and ransom.
- Security ROI (ROSI) Calculator Compute the return on a security investment from expected loss and mitigation effectiveness.
- Password Policy Generator Turn your password rules into a written policy plus Linux PAM and Windows config.
DevOps Utilities
View all →Cron, JSON, YAML, regex, redirects — everyday utilities for DevOps and backend engineers.
- Cron Expression Explainer Decode any cron schedule into plain English and preview the next run times.
- JSON Formatter & Validator Beautify, minify and validate JSON with clear error messages.
- YAML ↔ JSON Converter Convert YAML to JSON and back, with clear parse errors.
- Regex Tester Test regular expressions against text and inspect every match and group.
- .htaccess & nginx Redirect Generator Turn a list of old → new URLs into Apache .htaccess and nginx redirect rules.
- Unix Timestamp Converter Convert Unix/epoch timestamps to human-readable dates and back — seconds or milliseconds.
- JSON ↔ CSV Converter Convert a JSON array of objects to CSV and back, with proper quoting and headers.
- Number Base Converter Convert between binary, octal, decimal and hexadecimal — with big-number support.
Guides & explainers
All 34 guides →Clear explanations of the concepts behind the tools — networking, cryptography, passwords and DevOps.
- What Is a Subnet? CIDR Notation Explained Subnets and CIDR notation explained in plain English — what /24 really means, how masks work, and how to divide a network without the headache.
- What Is a JWT and How Does It Work? How JSON Web Tokens really work — the header, payload and signature, what signing proves, and the security mistakes that bite teams.
- Bcrypt vs SHA-256: Why You Don't Hash Passwords with SHA SHA-256 is fast — which is exactly why it's the wrong way to store passwords. Here's why bcrypt (or Argon2) wins, and how salting and cost factors work.
- How to Create a Strong Password (and Why Length Wins) Forget swapping letters for symbols. Here's what really makes a password strong — entropy, length, uniqueness — and the simple system that beats memorising rules.
- What Is Base64 Encoding? (And Why It's Not Encryption) Base64 turns binary data into safe text — but it is not encryption. Here's how it works, why it grows your data by a third, and when to reach for it.
- HMAC Explained: How Webhook Signatures Work How HMAC proves a message came from who you think it did — the mechanism behind Stripe and GitHub webhook signatures, and how to verify them safely.
📊 Original research
All research →- The Most Common Passwords of 2025 (and Why They Fail) '123456' still tops the list, 'admin' jumped to #2, and even P@ssw0rd-style passwords are cracked instantly. The 2025 most-common-passwords data, and what it teaches.
- How Many CVEs Are Published Each Year? The Vulnerability Explosion Vulnerability disclosures hit a record 48,185 in 2025 — roughly 133 a day. The year-by-year numbers, why the curve is bending upward, and what it means for defenders.
- IPv6 Adoption in 2026: The Year It Crossed 50% In March 2026, IPv6 quietly hit a milestone: for the first time, the majority of Google's traffic ran over IPv6. Here's what the data shows — and why sources disagree.
- How Long Does It Take to Crack a Password? (2026 Data) A computed brute-force time table by password length and character set — showing exactly why length beats complexity. Transparent, reproducible model.
How ToolSec works
ToolSec is a collection of single-purpose utilities for technical and security work. Unlike many online tools that send your input to a server to be processed, every ToolSec tool runs entirely in your browser. When you hash a string, decode a JWT, or generate a password, the computation happens locally using JavaScript and the browser's built-in Web Crypto API — nothing is uploaded.
That design has three benefits. It's private: sensitive values like internal IP ranges, API keys and tokens never leave your machine. It's fast: there's no network round-trip, so results appear the instant you click. And it's reliable: the pages are statically generated, so they stay available and load quickly anywhere.
Accuracy you can verify
The logic behind each calculator is covered by an automated test suite that checks results against known reference values — for example, standard hash test vectors and documented cron behavior. We also explain the method on every page so you can sanity-check the output yourself. Still, our tools are provided for information and convenience; always verify critical results before relying on them in production. See our Terms for details.
Frequently asked questions
Are these tools really free?
Yes. Every tool on ToolSec is free to use with no account required. The site is supported by advertising and a few relevant product referrals, which keeps it free for everyone.
Is my data sent to a server?
No. All tools process your input locally in your browser using JavaScript and the Web Crypto API. You can confirm this in your browser's Network tab — no request contains the data you enter.
Who is ToolSec for?
Security engineers, network administrators, developers, DevOps teams, and IT managers — anyone who needs fast, accurate utilities for everyday technical and compliance tasks.
Do I need to install anything?
No. ToolSec works in any modern browser with nothing to download or install. After your first visit, the static pages are cached and load almost instantly.