THE PRIVACY
WORKBENCH.
Production-grade browser primitives, not decorative simulations. Most inputs never leave your device. Tools marked External query contact the named upstream with the minimum data specified.
Breached password check
Uses Have I Been Pwned k-anonymity. SHA-1 is computed locally and only its first 5 hex characters are sent. The full password and full hash never leave the browser.
Encrypted DNS lookup
Resolve live DNS through Cloudflare DNS-over-HTTPS. The queried hostname is sent to Cloudflare; no fabricated results or local DNS assumptions.
File integrity hashes
Compute SHA-256, SHA-384 and SHA-512 entirely in your browser. Your file is never uploaded. Limit: 25 MB per file.
Photo metadata removal
Re-encode a JPEG, PNG or WebP through the browser canvas to a new JPEG. This removes common EXIF/GPS metadata but changes encoding and removes transparency; verify the output before sharing.
Secure tokens & UUIDs
Cryptographically secure 256-bit tokens from Web Crypto. Generate independent API-token candidates, identifiers or non-guessable strings; store private tokens securely.
Private text redactor
Replace common email addresses, IPv4 addresses, Ethereum addresses, and recognisable phone numbers with placeholders. Pattern-matching is not a guarantee that all personal data is removed.
Encrypted notes vault
Encrypt/decrypt notes locally using AES-256-GCM with PBKDF2-SHA256 (350,000 iterations), random salt and nonce. Download the ciphertext file. Lost passwords cannot be recovered.
Browser privacy posture
Read visible browser privacy signals and supported permission states without requesting new permissions. Not a unique fingerprint score or proof of anonymity.
Authenticator code generator
Generate a real 6-digit TOTP from a Base32 secret using local HMAC-SHA1 and a 30-second clock. The secret is never sent or stored by this service.
HTTP security header audit
Paste response headers from a site to check for common protections. This is a local parsing audit, not a remote penetration test.
On-chain privacy research
Privacy-preserving transactions involve protocol, smart-contract and jurisdictional risks. Tornado Cash is not operated, embedded, relayed or monetised here. Its US sanctions delisting in 2025 does not establish UK commercial regulatory clearance.