Security Tools Tools
Hash generators, header analysis, and security utilities
2 tools available — free, instant, no login required
All Security Tools Tools
Understanding Security Tools
Security utilities and header analysis tools provide the foundational building blocks for cybersecurity operations, cryptographic verification, and web application security assessment. Cryptographic hash functions (SHA-256, SHA-3, MD5, BLAKE2) are one-way mathematical transformations that produce a fixed-length digest from arbitrary input data, defined in FIPS 180-4 and FIPS 202. Hash functions are used for file integrity verification, password storage with salting via bcrypt/Argon2/scrypt, digital signatures, and blockchain transactions. The avalanche effect ensures that a single bit change in input produces a completely different hash output.
HTTP security headers are directives sent by web servers to browsers that control security-sensitive behaviors. Content-Security-Policy (CSP, RFC 9239) prevents cross-site scripting (XSS) and data injection attacks by specifying allowed content sources. HTTP Strict Transport Security (HSTS, RFC 6797) forces browsers to use HTTPS for all future connections. X-Frame-Options prevents clickjacking by controlling iframe embedding. Referrer-Policy controls how much referrer information is sent with requests. Permissions-Policy restricts access to browser APIs like camera, microphone, and geolocation.
Security headers are graded by tools like Mozilla Observatory and SecurityHeaders.com on an A-through-F scale. A comprehensive policy requires a strict CSP with nonce-based script allowlisting, HSTS with max-age of at least 31536000 seconds (one year) with includeSubDomains and preload, X-Content-Type-Options: nosniff, and Referrer-Policy: strict-origin-when-cross-origin. Missing headers are catalogued in OWASP Top 10 A05 (Security Misconfiguration) and should be audited regularly, ideally as part of CI/CD pipeline automated security checks. Beyond headers, web application security encompasses input validation, output encoding, secure cookie attributes (Secure, HttpOnly, SameSite=Strict), CORS policy configuration, and subresource integrity (SRI) for external scripts and stylesheets. A defense-in-depth approach combining all these layers significantly reduces the attack surface against common web threats.
Command-Line Usage
Run security checks and hash computations from your terminal:
macOS: shasum -a 256 filename.txt — compute SHA-256 hash of a file macOS / Linux: echo -n "text" | openssl dgst -sha256 — hash a string Linux: sha256sum filename.txt — compute SHA-256 on Linux Windows PowerShell: Get-FileHash filename.txt -Algorithm SHA256 — file hash Windows CMD: certutil -hashfile filename.txt SHA256 — certutil hash macOS / Linux: curl -sI https://example.com | grep -E "X-Frame|CSP|HSTS|Content-Security" — check security headers