Free Tools
Free Cybersecurity Tools
Free, browser-based learning tools that show you how passwords, hashes, encoding and ciphers actually work — by letting you try them, not just read about them. Everything runs locally in your browser: nothing you type leaves your device.
Educational demonstrators, not security scanners. These tools teach concepts — how a hash changes, why a short password is weak, why an old cipher fails. They do not scan your computer, test your accounts, or certify anything as safe. A good result from a learning tool is not proof that a password or a system is secure.
What these tools are
Each tool is a small, free page that demonstrates one idea. A password checker shows you what makes a password stronger or weaker. A hash generator shows you what a hash looks like and how changing one letter changes the whole result. An encoder shows you the difference between encoding and encryption — two things often confused. A cipher simulator lets you scramble a message with an old cipher and then break it, so you can see for yourself why it is not real security.
All 40 tools are live now, in eight groups: Tor & tracking (circuits, who-sees-what, fingerprinting), phishing & scams (spotter quiz, post-click triage, pause-before-you-click), passwords (strength, entropy, generator, checklist), hashes, encoding & ciphers (the encryption lab, hash generators, encoders and decoders), safety (ransomware simulator, breach explainer, risk assessments), family safety (quiz and plan builder), careers & research (SOC simulator, scope-checker, report builder, ATT&CK explorer, CVE decoder and more), and web basics (security headers and URL structure). Every tool page links back to the guide that explains the idea behind it.
What "runs locally in your browser" means
When a tool runs locally, all of its work happens on your own device, inside your browser. The text you type is processed by code that was downloaded with the page, and it is never sent to our servers — there is no server side to these tools at all. You can check this yourself in your browser's developer tools, on the Network tab: using a tool here makes no network requests.
This matters most for password and hash tools. A password is a secret, and the moment you send it to a server you have to trust that server completely — how it stores the password, who can see it, and whether it is logged. A local-only tool removes that whole risk, and it works offline once the page has loaded. Nothing you typed is stored anywhere after you close the page.
How to use the tools safely
Use the tools to learn, not to make promises about your own security. A password checker can tell you that a password is long and varied; it cannot tell you whether that password was already exposed in a breach, whether you reused it elsewhere, or whether the service holding it is secure. And a toy cipher — Caesar, ROT13 — is for learning only: never use one to protect a real message.
Two rules cover almost everything. First, never test a tool on a live system, account or network you do not own, and never scan or probe anything without the owner's written permission — learning tools are for your own examples, on your own device. Second, treat every result as a lesson, not a guarantee: a password that looks strong is the start of good practice, not the end of it.
Tor & tracking
How Tor works, who can see what when you browse, and what your browser reveals to every site you visit.
-
Tor
Tor Circuit Visualizer
Click each relay in a Tor circuit to see what the guard, middle and exit relay can — and cannot — see about you.
-
Privacy
Who Sees What? Packet Journey
Follow one web request and see what your Wi-Fi owner, provider, VPN and the website can each see — with HTTPS, VPN and Tor toggles.
-
Privacy
Browser Fingerprint Demo
See what a website can read about your browser — with no identifier created, stored or sent anywhere.
Phishing & scams
Practise spotting phishing, recover from a click, and pause before the next one.
-
Quiz
Phishing Spotter Quiz
Judge five fictional messages — delivery, bank, prize and investment scams — and learn the red flag in each one.
-
Triage
Clicked a Phishing Link? Triage Tool
You clicked a suspicious link. Say what happened and get a calm, ordered recovery checklist for your situation.
-
Checklist
Pause Before You Click Checklist
A printable one-minute checklist: five questions to ask before you click anything, for seniors, parents and teens.
Passwords
Check a password, measure its entropy, generate a strong one, and work through the habits that matter.
-
Passwords
Password Strength Checker
How strong is a password? Length, variety, patterns and common passwords, with a local-only estimate and a crack-time guide.
-
Passwords
Password Entropy Calculator
How many bits of entropy does a password have — and why do the 50, 60 and 80-bit targets disagree?
-
Passwords
Secure Password Generator
Generate strong random passwords and passphrases in your browser, using your device's cryptographic random source.
-
Passwords
Password Security Checklist
Twelve password habits that matter — unique passwords, a manager, two-factor authentication — with progress saved.
Hashes, encoding & ciphers
The encryption lab and its companions: hash generators, encoders and decoders, and the classic ciphers — all labelled as learning tools.
-
Encryption
Encryption Learning Lab
Scramble text with a Caesar cipher, hash it with SHA-256 and encode it in Base64 — and see why each one is different.
-
Hashing
SHA-256 Hash Generator
Generate a SHA-256 hash of any text in your browser — the 256-bit fingerprint used to check integrity.
-
Hashing
SHA-512 Hash Generator
Generate a SHA-512 hash of any text — a 512-bit fingerprint, twice the size of SHA-256, computed locally.
-
Hashing
MD5 Educational Demonstrator
See how MD5 works — and why it must never be used for security: hash any text and watch the avalanche effect.
-
Encoding
Base64 Encoder
Encode any text to Base64 in your browser — and learn why Base64 is encoding, not encryption.
-
Encoding
Base64 Decoder
Decode Base64 back to plain text — and see for yourself that Base64 hides nothing.
-
Encoding
URL Encoder
Encode text for use in a web address: spaces, symbols and non-English characters, percent-encoded.
-
Encoding
URL Decoder
Decode a percent-encoded web address and see what a link really says before you trust it.
-
Ciphers
Caesar Cipher Simulator
Scramble a message with the Caesar cipher — then break it by trying all 25 shifts.
-
Ciphers
ROT13 Encoder / Decoder
Encode and decode ROT13 — the fixed-shift cipher that hides spoilers, not secrets.
-
Hashing
Hashing Algorithm Explorer
Compare MD5, SHA-256 and SHA-512 side by side on the same text, and see the avalanche effect.
-
Encryption
Text Encryption Demonstrator
Scramble a message with a key and watch it become unreadable — a teaching demo, not real security.
-
Encryption
Text Decryption Demonstrator
Turn ciphertext back into readable text with the right key — or break it by trying all 25 keys.
Safety & privacy
Ransomware, breaches, footprints and risk: assess where you stand, and learn what a breach check really does.
-
Simulator
Ransomware Scenario Simulator
Walk through a ransomware attack decision by decision — and see why the official advice is never to pay.
-
Explainer
Data Breach Explainer
How breach checking really works, with mock screens and the k-anonymity trick — no real email needed.
-
Checklist
Digital Footprint Checklist
Audit your own digital footprint without giving anyone your email: a local-only checklist with progress saving.
-
Assessment
Privacy Risk Assessment
How exposed are you online? Eight questions, a risk band, and your top three actions.
-
Assessment
Online Safety Assessment
How safe are your everyday online habits? Eight questions, a safety band, and your top three fixes.
Family safety
One plan, three generations: a quiz for kids, teens and older adults, and a plan builder for the whole household.
-
Quiz
Family Safety Quiz
Pick a track — kids, teens or older adults — and answer five questions with practical, age-appropriate advice.
-
Plan builder
Family Safety Plan Builder
Build a one-page internet safety plan for your household — rules per person, who to call, and what to do — then print it.
Careers & research
Practise the jobs and the skills: SOC triage, bug bounty scope reading, report writing, ATT&CK, OSINT and CVEs.
-
Careers
SOC Alert Triage Simulator
Practise the real job of a Tier-1 SOC analyst: triage five synthetic alerts and learn how a professional decides.
-
Research
Bug Bounty Scope Checker
Learn to read a bug bounty scope page: mark targets in or out of scope on a fictional programme.
-
Research
Vulnerability Report Builder
Turn a lab finding into a professional vulnerability report — structured, downloadable, and disclosure-ready.
-
Research
MITRE ATT&CK Explorer
Pick a tactic, see the techniques attackers use, and learn what evidence a SOC would look for.
-
Careers
Certification Path Picker
Which cybersecurity certification first? Four questions, an ordered plan, and no fee figures.
-
Research
OSINT Verification Exercise
Verify four claims from a synthetic case file using the two-source rule and the four Ds.
-
Research
CVE Decoder
Decode a CVE ID and get the official links to check it — CVE.org, NVD and CISA KEV.
-
Careers
Cybersecurity Salary Reality Checker
What do cybersecurity jobs actually pay? The published median next to the entry-level band — with sources and dates.
Web basics
Read a website's defences the way a professional does — by pasting, never by probing a live site.
-
Web
Security Header Learning Tool
Paste a website's response headers and learn what each one does — CSP, HSTS, X-Content-Type-Options and more.
-
Web
URL Structure Analyzer
Paste any web address and see it broken into scheme, domain, path and query — with the phishing red flags explained.
Where to go next
Every tool on this page is paired with a guide that explains the idea behind it in depth. If a tool left you with questions, follow its "Related guides" links — they are the same guides the tools were built from. And if you want structure rather than single tools, the Learning Paths page turns the guides and tools into seven ordered courses.
Frequently asked questions
Are these tools free?
Yes. Every tool on this site is free to use, with no account, no sign-up and no payment. They are learning tools built for this site, and they run in your browser.
Is it safe to type my real password into a password checker?
Our password tools run entirely in your browser, so what you type never leaves your device. Even so, the safest habit is to test a password that is built like yours — same length and style — rather than your real password. Never type a real password into any website you do not fully trust, and never use a checker that sends your password to a server.
Can a tool here tell me if my password was leaked in a breach?
No. This site does not offer a real-email or real-password breach checker, and it never will: checking a real password against a server would mean sending it somewhere. The tools here teach you how passwords, hashes and breaches work; they do not check your real accounts.
Are all the tools live now?
Yes. All 40 tool pages are live, grouped by purpose below: Tor and tracking, phishing and scams, passwords, hashes and encoding, safety quizzes, family safety, careers and research, and web basics. Each tool page links back to the guide that explains the idea behind it.