Skip the island and read the website

Hash Generator — SHA-1, SHA-256, SHA-384, SHA-512

← Safe HarborThe Creative Island · Island 14

SHA-256 and friends, computed by your browser's own crypto engine — text in, digest out, nothing uploaded.

One-way by design: the same text always gives the same digest, but the digest can never be reversed to the text.

How to use this tool

  1. Type or paste your text (hashing starts automatically).
  2. Read the four digests — SHA-256 is today's general-purpose standard.
  3. Copy the SHA-256 digest if you need it for verification or deduplication.

Example

hello → SHA-256 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824. Change one letter — 'Hello' — and the digest becomes completely different: 185f8db32271fe25f561a6fc938b2e26… This is the avalanche effect.

The formula

digest = SHA(text) — fixed-length output (160/256/384/512 bits) regardless of input size

What the result means

A hash is a fingerprint: deterministic (same input, same digest), avalanche (any change rewrites everything), and one-way (no algorithm recovers the input). That trio powers file integrity checks, password storage (with salting), deduplication and blockchain links. SHA-1 is shown only because legacy systems still ask for it — for anything new, use SHA-256 or better.

Frequently asked questions

Why is SHA-1 in the list if it's broken?

Collision attacks exist against SHA-1, so it's retired for security uses — but terabytes of legacy systems still request it. It's here for compatibility, marked with a warning label in spirit.

Can a hash be reversed to reveal the original text?

No — not by computation. 'Reversal' sites just look up precomputed tables of common inputs; unique, random inputs have no entries to find.

How are passwords hashed then?

With special password algorithms (bcrypt, Argon2) that are deliberately slow and salted — SHA alone is too fast, making leaked-hash cracking cheaper. Different tools for different jobs.

Is my text uploaded?

No — hashing happens in your browser via the Web Crypto API.

More tools from Safe Harbor

Password Strength CheckerJudge an existing passwordPassword GeneratorStrong random passwordsRandom Token GeneratorAPI keys & secretsBase64 Encoder/DecoderOn Circuit Cove

Explore the island world

Privacy & data: this tool runs entirely in your browser — nothing you type is uploaded, saved or sent anywhere. · Disclaimer: everything is generated or checked locally in your browser — nothing you type is transmitted, stored or logged anywhere. · Privacy Policy · Disclaimer
Read more
Post a Comment

Random Token Generator — API Keys & Secrets

← Safe HarborThe Creative Island · Island 14

API keys, hex secrets, URL-safe tokens — generated with cryptographic randomness, on your device.

Generate client-side only for local use or your own system. Real production API keys must come from the service that will verify them — never from a web page.

How to use this tool

  1. Choose the byte length (32 bytes / 256 bits is the modern standard for secrets).
  2. Pick a format: hex for classic API keys, URL-safe for paths and query strings, Base64 for compact tokens.
  3. Generate, copy, and store it somewhere safe — there is no 'recover' button for random secrets.

Example

A 32-byte hex token looks like 9f86d081884c7d659a2feaa0c55ad015… — 256 bits of entropy, meaning every possible key is equally likely and guessing is hopeless at any scale.

The formula

crypto.getRandomValues → N random bytes → hex (2 chars/byte), URL-safe base64url, or 6-bit alphabet

What the result means

Tokens differ from passwords in one way: no human ever types them, so length and uniform randomness are the only design constraints — and both are free. 256 bits is the standard because it leaves brute-force dead for any future hardware we can imagine, and because hashing (which halves the search space) still leaves it uncrackable.

Frequently asked questions

Can I use these as real API keys?

For local projects, testing and your own systems, yes. For a production service, the issuing server must generate the key (it stores a hash to verify) — a page-generated string can't be verified by anyone but you.

What length should I pick?

32 bytes (256 bits) for anything. 16 bytes (128 bits) is acceptable for short-lived or low-value tokens.

Why URL-safe instead of standard Base64?

Standard Base64 contains + and /, which break URLs and filenames; the URL-safe alphabet swaps them for - and _ and drops padding.

Are generated tokens stored anywhere?

No — generation is local; refresh the page and it is gone forever.

More tools from Safe Harbor

Password GeneratorStrong random passwordsHash GeneratorSHA-256 & friendsRandom Number GeneratorFair random drawsPassword Strength CheckerJudge an existing password

Explore the island world

Privacy & data: this tool runs entirely in your browser — nothing you type is uploaded, saved or sent anywhere. · Disclaimer: everything is generated or checked locally in your browser — nothing you type is transmitted, stored or logged anywhere. · Privacy Policy · Disclaimer
Read more
Post a Comment

Random Group Picker — Fair Teams & Winners

← Safe HarborThe Creative Island · Island 14

Paste the names, pick how many groups — get fair, unbiased teams in one click.

How to use this tool

  1. Paste your names, one per line.
  2. Choose the number of groups (or switch to winner-picking mode).
  3. Press Shuffle — unbiased groups, balanced in size.

Example

24 students into 4 groups: three shuffled teams of 6, no clustering of friends, no 'teacher's pets together' accusations — the loudest classroom argument, deleted in one click.

The formula

Fisher-Yates shuffle driven by crypto randomness → every arrangement equally likely

What the result means

Random grouping kills two biases at once: the organizer's unconscious bias (friends, strong-with-strong) and the group's suspicion of it. Fisher-Yates with a cryptographic source is the gold standard — every permutation has exactly equal probability, which no 'names in a hat' with awkward folding can promise.

Frequently asked questions

Are the groups really random?

Yes — Fisher-Yates shuffle on crypto randomness: every possible grouping is equally likely, with no pattern a participant could predict.

Can I pick a single winner?

Yes — switch mode to 'Pick N winners only' and set the count.

Why is one group smaller?

When names don't divide evenly, the first groups get the extra member — sizes never differ by more than one.

Are the names uploaded?

No — the shuffle happens in your browser; the name list never leaves your device.

More tools from Safe Harbor

Random Number GeneratorFair random drawsPassword GeneratorStrong random passwordsRandom Token GeneratorAPI keys & secretsInterview CountdownOn Career Station

Explore the island world

Privacy & data: this tool runs entirely in your browser — nothing you type is uploaded, saved or sent anywhere. · Disclaimer: everything is generated or checked locally in your browser — nothing you type is transmitted, stored or logged anywhere. · Privacy Policy · Disclaimer
Read more
Post a Comment

Random Number Generator — Fair Draws, Any Range

← Safe HarborThe Creative Island · Island 14

Pick a number between anything and anything — once or many times, with or without repeats.

How to use this tool

  1. Set your range (1–100, 1–6 for dice, 1–49 for lottery style).
  2. Choose how many numbers and whether repeats are allowed.
  3. Press Draw — each press is a fresh, independent draw.

Example

Class raffle with 60 students: From 1, To 60, How many 3, No repeats → three distinct winners in one click, immune to the 'whose handwriting wins' effect of paper draws.

The formula

rejection-sampled crypto.getRandomValues → uniform integers, no modulo bias

What the result means

True fairness in draws comes from uniform randomness — this generator rejects out-of-range values before mapping (avoiding modulo bias) and uses the browser's cryptographic source, the same one that guards HTTPS. That's a stronger guarantee than dice, and far stronger than 'the boss picks'.

Frequently asked questions

Can I use it for a raffle or giveaway?

Yes — it's a fair draw: every number has identical probability. For public trust, screenshot the result.

Why no repeats by default?

Most draws (winners, orderings) want unique picks. Uncheck it for independent events like dice rolls.

Is the randomness really cryptographic?

Yes — crypto.getRandomValues, seeded by your operating system's secure entropy pool. Math.random is only used as a fallback on ancient browsers.

Are my draws recorded?

No — nothing is stored or sent; refresh and the history is gone.

More tools from Safe Harbor

Random Group PickerFair team sortingPassword GeneratorStrong random passwordsProbability CalculatorOn Research ReefRandom Token GeneratorAPI keys & secrets

Explore the island world

Privacy & data: this tool runs entirely in your browser — nothing you type is uploaded, saved or sent anywhere. · Disclaimer: everything is generated or checked locally in your browser — nothing you type is transmitted, stored or logged anywhere. · Privacy Policy · Disclaimer
Read more
Post a Comment

Password Strength Checker — Test Without Judgement

← Safe HarborThe Creative Island · Island 14

Type a test password — see its entropy, estimated crack time, and every weakness. Stays on your device, guaranteed.

Test with a similar-shaped password if you are cautious — same length and pattern, different characters. The analysis works the same.

How to use this tool

  1. Type or paste the password to test — it stays in this page's memory only (use the show/hide toggle).
  2. Read the entropy bits, the verdict bar and the crack-time estimate.
  3. Fix every finding the checker lists, then re-test.

Example

P@ssword123 tests as 10 chars but the checker finds the common word, the word+digits pattern and the substitution — effective strength collapses to WEAK. A random 16-character output from the Password Forge scores ~99 bits: VERY STRONG.

The formula

effective bits = effective length (patterns removed) × log₂(character pool) · crack time at 10¹² guesses/sec

What the result means

Crackers don't brute-force blindly — they try wordlists, patterns and substitution rules first, so 'P@ssword1' falls in seconds despite its 9 characters. Real strength = randomness the attacker cannot model. The crack-time figure assumes an offline attack on a leaked hash, the worst realistic case.

Frequently asked questions

Is it safe to paste my real password here?

The page has no network calls and no storage — the check runs in your browser only. If uneasy, test a similar-shaped dummy (same length, same pattern).

What is a good target?

70+ bits for accounts that matter, 100+ for master passwords and encryption keys. Length is the cheapest way up: each random character adds 5-6 bits.

Why does the checker say 8 random chars are only FAIR?

Because GPU rigs really do crack random 8-character hashes in hours when they steal the hash. Online logins are rate-limited; leaked-password cracking is not.

Does adding '2024' to a word help?

It adds a pattern, not strength — 'word+year' is among the first rules every cracking engine tries.

More tools from Safe Harbor

Password GeneratorGenerate a strong oneHash GeneratorSHA-256 & friendsRandom Token GeneratorAPI keys & secretsRandom Group PickerFair team sorting

Explore the island world

Privacy & data: this tool runs entirely in your browser — nothing you type is uploaded, saved or sent anywhere. · Disclaimer: everything is generated or checked locally in your browser — nothing you type is transmitted, stored or logged anywhere. · Privacy Policy · Disclaimer
Read more
Post a Comment

Password Generator — Strong Random Passwords, Locally

← Safe HarborThe Creative Island · Island 14

Cryptographically random passwords — your length, your character sets, generated on your own device.

How to use this tool

  1. Set your length — 16+ is the modern default; 20+ for anything precious.
  2. Tick the character sets (the site requiring the password will state its rules).
  3. Press Generate and Copy — then store it in a password manager, never a text file.

Example

A 16-character password from all four sets carries ~99 bits of entropy — offline brute-force at a trillion guesses per second would outlive the planet. The same 16 characters from lowercase-only carries just 75 bits, and 'P@ssword1' carries about 10.

The formula

entropy = length × log₂(pool size) · randomness from crypto.getRandomValues (Web Crypto)

What the result means

Password strength is almost entirely a function of randomness and length — substituting '@' for 'a' adds nothing if a human chose it, because crackers try those substitutions first. True random output has no patterns to model, which is why generated passwords can be shorter than memorable ones and still stronger.

Frequently asked questions

Can this site see or store my password?

No. Generation happens in your browser with your device's own random generator; the password is displayed locally and never transmitted. Closing the tab erases it forever.

Is 8 characters still okay?

Not for anything you care about. Modern GPU rigs crack random 8-character passwords in hours. Use 16+ generated characters, or long passphrases where humans must remember.

Why avoid lookalike characters (I, l, 1, O, 0)?

The generator quietly omits them — they cause transcription errors when a password must be typed from paper or read over the phone.

How am I supposed to remember these?

You are not — that is the password manager's job. Remember one strong master passphrase; let the manager hold the rest.

More tools from Safe Harbor

Password Strength CheckerJudge an existing passwordRandom Token GeneratorAPI keys & secretsRandom Number GeneratorFair random drawsHash GeneratorSHA-256 & friends

Explore the island world

Privacy & data: this tool runs entirely in your browser — nothing you type is uploaded, saved or sent anywhere. · Disclaimer: everything is generated or checked locally in your browser — nothing you type is transmitted, stored or logged anywhere. · Privacy Policy · Disclaimer
Read more
Post a Comment
Subscribe to: Posts (Atom)