OnSumoTools

Privacy tools

Security checks that stay on your device. No passwords or secrets are uploaded.

These tools evaluate and generate credentials without sending anything to a server. The password strength meter calculates entropy in bits, estimates crack time at three attack speeds, and flags matches against a common-password list — all done client-side so the password you are testing never leaves the browser. The cryptographically secure password generator uses the Web Crypto API to produce random characters from a configurable character set with no server involvement.

The Diceware passphrase generator uses the EFF long wordlist and the Web Crypto API to pick words, producing passphrases that are both high-entropy and memorable. The HTTP header security analyzer grades six security response headers — including Content-Security-Policy, Strict-Transport-Security, and X-Content-Type-Options — from A to F based on presence and configuration. The browser cookie parser decodes Set-Cookie headers and flags attributes like HttpOnly, Secure, and SameSite so you can audit cookies without a proxy tool.

Password strength meter

Live entropy bar, three crack-time speeds, common-password list, pattern warnings, no storage.

HTTP header security analyzer

Six security headers graded A to F, per-header pass/warn/fail, missing list, CSP template copy.

Password generator

Cryptographically secure random passwords with charset options, entropy meter, and crack-time estimate.

Diceware passphrase generator

EFF wordlist passphrases with crypto random picks, dice roll display, entropy, and crack time.

How to Decode Browser Cookies (HTTP Cookie Parser)

Parse Set-Cookie headers, decode values, and flag HttpOnly, Secure, SameSite, and expiry issues.

Security tools that don't ask for your secrets

It would be silly to type a real password into a website that stores it. So these tools don't. The password meter, generators and cookie parser all run locally in your browser. Nothing you enter is saved, logged or sent anywhere.

You can check this yourself. Open your browser's network tab, use a tool, and watch. No requests carry your input.

Passwords: strength, generation and passphrases

The password strength meter shows entropy live and estimates crack time at three different attacker speeds. It checks against a list of common passwords and warns about patterns like keyboard walks and repeated characters. A password such as "Summer2024!" looks strong to old-school rules and falls in seconds to a real attacker.

The password generator uses your browser's cryptographically secure random source. You pick length and character sets, and it shows entropy and a crack-time estimate. Length wins. A 16 character random password beats a clever 10 character one every time.

The Diceware passphrase generator builds passwords from the EFF word list. It shows the dice rolls and the entropy. Four to six random words are easy to remember and hard to guess. The words must be random. Picking your favorite lyric doesn't count.

  • Use a password manager so every site gets a unique password
  • Turn on two-factor authentication for email, banking and work accounts
  • Reserve passphrases for the few things you must memorize, like your manager's master password

HTTP security headers

If you run a website, headers are your cheapest security upgrade. The HTTP header security analyzer grades six important ones from A to F and marks each as pass, warn or fail. It lists what's missing and gives a Content Security Policy template you can copy.

A quick tour of what these do. Strict-Transport-Security tells browsers to use HTTPS only. Content-Security-Policy limits where scripts can load from, which blunts cross-site scripting. X-Content-Type-Options stops browsers guessing file types. Frame-ancestors or X-Frame-Options prevent your site from being embedded in a hostile page. Referrer-Policy and Permissions-Policy control what leaks and what features pages may use.

Roll out CSP carefully. Start in report-only mode, fix what breaks, then enforce. A strict policy added in one go can take your site down.

Cookies, decoded

The cookie parser takes a Set-Cookie header and breaks it into pieces: name, value, domain, path, expiry and flags. It flags problems such as a missing HttpOnly, Secure or SameSite attribute.

HttpOnly keeps JavaScript from reading the cookie, which limits damage from script injection. Secure sends it only over HTTPS. SameSite controls whether it travels with cross-site requests, which helps against CSRF. A session cookie that lacks all three is a gift to attackers.

It also decodes values. Many cookies hold Base64 or URL-encoded data. Take a look at what yours contain. If you see raw personal data, that's a red flag.

Habits that matter more than any tool

Reusing passwords is the biggest risk. One breach at a small forum can expose your email.

Phishing beats strong passwords. Check the web address before you log in, and be suspicious of urgent messages.

Keep software updated. Most attacks use old, known holes.

Back up important files somewhere offline. Ransomware can't encrypt a drive that isn't plugged in.

Limits

A strength meter can't know if your password was already leaked. Check it against a breach service like Have I Been Pwned using a method that doesn't expose the full password. And a header grade tells you about headers only. It isn't a full security audit.

A short checklist for this week

Turn on a password manager and change your email password first, since email resets everything else. Switch on two-step sign-in for email, banking and social accounts. Check which apps can see your location. Update your phone and browser.

That list takes an hour and blocks most of the common problems. Test any password against the strength tool, in your browser only.

A quick habit list

Use a password manager. Turn on two-factor sign-in for email, banking and your phone account first. Update your devices when a patch lands. Those three habits stop most of the attacks that hit ordinary people.

Then use the tools in this section to check your work, not to replace the habits.