Security tools
Dice Roller
Free online dice roller — roll any number of dice with any number of sides (not just standard d4/d6/d20), with a running roll history and no ads.
Fake IBAN Generator
Free fake IBAN generator for 14 countries with valid mod-97 checksums, for testing payment forms and fintech apps — no real bank account is attached. Unlike two popular generators we checked (10015.io, fakeiban.org), this one shows the exact checksum math (letters-to-digits, the mod-97 remainder, the final check digit) so developers can verify it themselves instead of trusting a black box, and displays a prominent test-data-only warning that neither competitor shows on-page.
Hidden Unicode / AI Prompt Scanner
Scan text live for invisible Unicode characters — the Unicode Tags block and bidi overrides are flagged High risk (the exact categories documented in real AI agent prompt-injection research), while common zero-width, NBSP, and BOM characters are flagged Low.
List Randomizer
Free list randomizer / random name picker for raffles, giveaways, and team assignment — with a 'remove picked entries' toggle on by default, so drawing 1st, 2nd, and 3rd place in a row never repeats a winner. We checked two popular pickers (gigacalculator.com, randomlists.com) directly and neither documents this mode. No ads anywhere in the working area, by this site's design.
Password Generator
Generate cryptographically random passwords instantly — up to 128 characters, up to 20 at once, with an option to exclude ambiguous characters and a live strength meter.
Password Strength Checker
Check a password's real-world strength using pattern-based analysis (not raw entropy) — see exactly why it's weak and what to change, entirely in your browser.
Photo Privacy Checker
Check a photo for hidden GPS location live — nothing is ever uploaded. Works with JPG, PNG, WebP, and HEIC/HEIF (iPhone photos). A red banner and map link show exactly where it was taken; a green banner confirms when it's clean; an amber banner is honest when metadata can't be fully verified rather than falsely claiming safety. Download a copy with all metadata removed in one click.
Random Number Generator
Free random number generator with custom range, decimal-place support, no-duplicates mode, and sorting — using the Web Crypto API (crypto.getRandomValues) as its randomness source, and saying so on the page. We checked two popular generators (commentpicker.com, calculatorsoup.com) directly: both are integer-only with no decimal option, and one only vaguely calls itself a 'PRNG' without naming its actual source.
From the blog
Passkeys Just Passed 5 Billion — But Most Accounts Still Run on Passwords
Passkey sign-ins now succeed 93% of the time versus 63% for passwords, and global adoption has crossed 5 billion. But 87% of organizations still use passwords for customer logins — here's why passwords aren't going away yet, and how to make the ones you still use stronger.
2026-09-04 Most online dice rollers only let you pick real dice shapes — this one rolls a d3 or a d47 just as easily
A d4, d6, d8, d12, and d20 exist as physical objects. A d3 or a d15 doesn't — but plenty of games and decisions still need one. Most dice roller sites simply refuse.
2026-09-02 Two fake IBAN generators say their output 'passes validation.' Neither shows the math.
We checked 10015.io and fakeiban.org directly — both claim mod-97 compliance but neither one shows you the actual checksum calculation. So we built one that does.
2026-09-01 Drawing 1st, 2nd, and 3rd place with a random name picker? Watch out for repeat winners.
We checked two popular name pickers directly — neither documents a way to stop the same name from winning twice across separate draws.
2026-09-01 Two random number generators. One won't give you a decimal. The other won't say how random it is.
commentpicker.com and calculatorsoup.com are solid tools — but neither supports non-integer results, and one just calls itself a 'PRNG' without naming an actual source.
2026-09-01 Most invisible-character checkers treat every hidden character the same. Only some of them are the ones real attacks actually use.
We checked two invisible-character tools directly — one is genuinely live but never mentions AI agents at all, the other needs a button click despite its name. Neither separates the character categories that 2026 security research actually documented as AI agent injection vectors from the ones that are just copy-paste accidents. Ours does.
2026-08-30 A location-privacy tool that requires you to upload the photo to check its location. Read that again.
We checked pic2map.com directly — a photo-location viewer whose own terms say uploading is required. We also found viewers and removers split across separate tools. This one checks and removes GPS in the same screen, and nothing ever leaves your browser.
2026-08-30 LastPass's password generator needs a button click and gives you one password. Ours gives you twenty, instantly.
A password manager's own generator has no way to exclude confusing characters or make several passwords at once, and needs a Generate click for every change. Ours updates live and can make up to 20 at a time.
2026-08-29 A Concordia University study found major password meters give "blatantly misleading" scores. We tested "password123456" to see why.
Academic research has found that entropy-based password meters create a false sense of safety — a long password can score well while still being trivially guessable. We fed "password123456" (14 characters) into our own tool and it correctly called it weak, in two seconds, and said exactly why.
2026-08-29