Security Tools
Security and privacy tools for auditing, testing, and generating security-related content.
Password Auditor
Check password strength and patterns
JWT Decoder
Decode and verify JWT tokens
Hash Generator
Generate MD5, SHA-256, SHA-512 hashes
XSS Scanner
Basic XSS vulnerability scanner
Privacy Policy Generator
Generate privacy policies
Educational Purpose
These security tools are provided for educational and testing purposes. Some tools provide simulated results due to browser limitations. Always use proper security testing tools and follow responsible disclosure practices.
About the Security Tools
NKable's security tools all act on input you supply, entirely in your browser: hashing a string, decoding a JWT's claims, auditing a password, scanning pasted HTML for injection patterns, and generating a privacy policy.
Every tool in this category acts on something you paste in, and does it in your browser. The hash generator produces MD5 through SHA-512 digests. The JWT decoder splits a token into its header, claims and signature and shows when it expires. The password auditor scores strength and entropy and flags common patterns. The XSS scanner looks through pasted HTML for script tags, event-handler attributes and javascript: URLs. The privacy policy generator assembles a policy document from the answers you give it.
Because nothing is transmitted, these are safe to use on material you would not upload — a live JWT, a password you are about to set, markup from an internal application.
There are no TLS, security-header or CORS checkers here any more. A browser cannot read another site's certificate or response headers, and cannot stand in for your origin in a CORS test, so those pages were guessing. For auditing a live site, Qualys SSL Labs grades TLS configuration, `curl -I` shows response headers, and Mozilla Observatory covers a broad set of protections.
How to use the Security Tools
- Pick a tool. Choose hashing, JWT decoding, password auditing, XSS scanning or policy generation.
- Paste your input. Enter the string, token, password or markup you want examined.
- Read the result. Each tool explains what it found and why it matters.
- Use external tools for live sites. SSL Labs, curl -I and Mozilla Observatory audit a running site.
Security Tools features
- Hash generator covering MD5, SHA-1, SHA-256, SHA-384 and SHA-512
- JWT decoder with claim and expiry inspection
- Password strength and entropy auditing
- XSS pattern scanning on pasted HTML
- Privacy policy generation
- Every tool runs client-side — nothing is uploaded
Frequently asked questions
Is my input uploaded?
No. Every tool in this category runs in your browser, so tokens, passwords and markup never leave your device.
Can I check another site's TLS or security headers here?
No. A browser cannot read a cross-origin certificate or response headers. Use Qualys SSL Labs or curl -I instead.
How thorough is the XSS scanner?
It matches known injection patterns in HTML you paste — script tags, event handlers, javascript: URLs. It is a first pass, not an audit.
Is the password auditor safe to use on a real password?
Yes. Scoring happens locally and the password is never transmitted or stored.
Are these a substitute for a security review?
No. They cover specific checks and background knowledge, not a full assessment.