Free Online Security & Privacy Tools

Free Online Security & Privacy Tools

ToolRux offers 14 free online security and privacy tools designed for developers, security professionals, and anyone who values data protection. Decode tokens, assess password strength, encrypt sensitive data, look up IP addresses, and generate privacy policies — all without installing anything.

Token & Authentication Tools

• JWT Decoder — Decode JSON Web Tokens instantly. Inspect the header, payload, and signature. Check expiration, issued-at, and not-before claims with color-coded status.
• Password Strength Checker — Analyze any password's entropy, estimated crack time (at 10 billion guesses/sec), character composition, and common pattern detection. Get actionable improvement suggestions.
• TOTP / 2FA Code Generator — Generate time-based one-time passwords (TOTP) for two-factor authentication. Enter a Base32 secret and get the current 6-digit code with a countdown timer.

Encryption & Hashing

• Encryption / Decryption Tool — Encrypt and decrypt text using AES-256-GCM with PBKDF2 key derivation (100,000 iterations). Everything runs client-side — your data never leaves your browser.
• SRI Hash Generator — Generate Subresource Integrity hashes (SHA-256, SHA-384, SHA-512) for external scripts and stylesheets to protect against CDN tampering.

Network & Privacy

• IP Address Lookup — Look up geolocation, ISP, ASN, timezone, and other details for any IPv4 or IPv6 address. One-click "My IP" to check your own address.
• Data Breach Checker — Check if your email has been exposed in known data breaches using the Have I Been Pwned API.
• SSL Certificate Checker — Verify SSL/TLS certificate details including issuer, expiry date, and chain status for any domain.
• CORS Tester — Test Cross-Origin Resource Sharing headers for any URL to debug CORS configuration issues.
• CSP Header Generator — Build Content Security Policy headers with a visual editor to protect against XSS and injection attacks.
• DNS / WHOIS Lookup — Query DNS records (A, AAAA, CNAME, MX, NS, TXT, SOA, SRV) via Cloudflare and Google DoH, and retrieve WHOIS registration data via RDAP — all from your browser.

Legal Document Generators

• Privacy Policy Generator — Generate a comprehensive, customizable privacy policy with GDPR, CCPA, and COPPA compliance sections. Export as Markdown and download instantly.
• Terms of Service Generator — Generate a terms of service document for your website or app with customizable clauses.
• Cookie Policy Generator — Generate a cookie policy with tracking consent details, cookie categories, and compliance language.

Need developer tools? Check out our Developer Tools for hashing, encoding, regex testing, and more. Explore our Converter Tools for data format conversions, or try our Calculators for financial and math calculations.

Why Use ToolRux Security Tools?

• Client-Side Processing — Encryption, decoding, and password analysis all happen in your browser. No data is sent to any server.
• Free & No Sign-up — Every tool is free to use with no account required.
• Modern Cryptography — AES-256-GCM encryption, PBKDF2 key derivation, and Web Crypto API — industry-standard algorithms.
• Mobile Friendly — Fully responsive design on phones, tablets, and desktops.
• Dark Mode — Easy on the eyes with automatic dark mode support.
• Open Standards — JWT, AES-GCM, SHA-256 — all based on well-documented, widely-adopted standards.

Frequently Asked Questions

Is my data safe when using these tools?

Yes. All processing happens entirely in your browser using the Web Crypto API. No passwords, tokens, or encrypted text are ever sent to our servers.

Can I decode any JWT token?

You can decode and inspect the header and payload of any valid JWT. Note that signature verification requires the secret key or public key, which this tool does not perform — it's a decoder, not a verifier.

How does the password strength checker work?

It calculates entropy based on the character pool size and password length, estimates crack time at 10 billion guesses per second (modern GPU cluster), checks against a database of common passwords, and detects keyboard sequences and repeated characters.

What encryption algorithm is used?

AES-256-GCM with PBKDF2 key derivation using SHA-256 and 100,000 iterations. A random 16-byte salt and 12-byte IV are generated for each encryption, ensuring unique ciphertext even for identical inputs.

Can I use the generated privacy policy for my website?

The generator creates a solid starting point with common sections for GDPR, CCPA, and COPPA compliance. However, we recommend having a legal professional review your final policy to ensure it meets your specific regulatory requirements.

How accurate is the IP address lookup?

IP geolocation is generally accurate to the city level for most addresses. VPN, proxy, and some mobile carrier IPs may show the server location rather than the user's actual location.

What DNS record types does the DNS/WHOIS Lookup support?

The DNS/WHOIS Lookup queries A, AAAA, CNAME, MX, NS, TXT, SOA, and SRV records using Cloudflare and Google DNS-over-HTTPS. WHOIS data is retrieved via RDAP (Registration Data Access Protocol) for domain registration details.

Do these tools work offline?

JWT decoding, password strength checking, and encryption/decryption all work offline once the page is loaded. The IP address lookup and DNS/WHOIS lookup require an internet connection as they query external APIs.

Are these tools really free?

Yes — every security and privacy tool on ToolRux is completely free to use with no limits, no watermarks, and no sign-up required.