Security & Privacy Tools

Test password strength, analyze suspicious links and email headers, see which trackers a website loads, and plan your two-factor coverage and post-breach steps.

The password strength estimator measures real entropy, shows the patterns a cracker exploits, and estimates crack time against modern hashing. Its breach check is privacy-preserving: only the first few characters of a hash ever leave your browser, never the password. The password generator creates cryptographically secure replacements on the spot.

When something suspicious lands, the phishing link analyzer and email header analyzer read the forensics so you don't have to click anything. And if your data has already leaked, the breach directory and the credit freeze action plan cover what to do next, in the order that matters.

137 Foundry — custom app building studio

Security & Privacy Tools

Breach Directory & Exposure Timeline

Every known breach, what it leaked, and how long it stayed hidden.

Credit Freeze & Post-Breach Action Plan

What to actually do in the 48 hours after your data leaks, in the order that matters.

Email Header Analyzer

Paste the raw headers of a suspicious message and read the forensics in plain English.

Password Generator

Generate cryptographically secure passwords with strength analysis

Password Strength & Crack-Time Estimator

Real entropy, the patterns a cracker exploits, and how long it survives bcrypt vs MD5.

Router Security Scorecard

The real vulnerabilities published against your actual router model, ranked by what a stranger can reach.

Scam & Phishing Link Analyzer

Paste a suspicious link and see what it really is, without clicking it.

Two-Factor Auth Coverage Planner

Which of your accounts can actually be protected, ranked by what a phishing page cannot defeat.

Website Privacy X-Ray

See every company a website reports you to, before you consent to anything.

Using Security & Privacy Tools in the Right Order

Start with the front door: passwords and 2FA

Most account takeovers don't involve sophisticated hacking. They involve a password reused on a site that got breached. Start by running your important passwords through the strength estimator. It shows entropy in bits, the dictionary and keyboard patterns that collapse it, and how long the password survives against bcrypt versus a fast hash like MD5. Replace the weak ones with output from the generator.

Then run the 2FA coverage planner. Not all second factors are equal, so it ranks your accounts by which protection actually stops a phishing page. That way you spend your effort where it counts.

When something suspicious lands

Don't click to find out. The phishing link analyzer examines a pasted link, including the domain tricks, the redirects, and the lookalike characters, without you ever visiting it. For a suspicious email, the header analyzer reads the routing forensics (SPF, DKIM, the path the message actually took) and translates them into plain English.

If the message claims your data was exposed, check the breach directory instead of trusting the message. It lists what each known breach actually leaked and when. Scare emails routinely cite real breaches to make fake threats sound credible.

What these tools won't do

Nothing here scans your device for malware, removes a virus, or monitors your accounts in real time. Those jobs belong to endpoint security software and your accounts' own alerts. The privacy x-ray shows you which companies a website reports visitors to, but it can't opt you out of data brokers that already hold your information.

What the category does is put honest numbers and clear next steps around decisions you'd otherwise make on gut feel: which password is actually weak, which link is actually dangerous, which account deserves a hardware key, and what to do first when your data leaks. The credit freeze action plan exists for exactly that last moment.

Honey-Do Tracker — home maintenance for landlords and property managers

Who Are These Tools For?

Everyday Users

Check whether your passwords would survive a real cracking rig, generate stronger ones, and plan which accounts get which kind of two-factor.

Anyone Holding "That Email"

Paste a suspicious link or raw email headers and read what it really is in plain English, without clicking or replying.

Post-Breach Responders

Look up what a breach actually leaked, then follow the 48-hour action plan: freezes, resets, and monitoring in priority order.

Security & Privacy vs Dev & Tech: Defending Yourself vs Building Things

Security & Privacy tools are for defending yourself: your passwords, your inbox, your identity, your router. The inputs are personal, like a password you use, a link you received, or a breach that named you, and the outputs are decisions and next steps.

Dev & Tech serves people building software: hash generators, encoders, formatters, and testing utilities where a hash is a work artifact rather than a defense. The overlap is real, since both categories understand hashing, but the audience differs. If you're checking whether your own password survives a cracking rig, you're here. If you need an MD5 checksum for a file you're shipping, that's Dev & Tech.

Frequently Asked Questions

No. The strength analysis runs in your browser. The optional breach-exposure check uses k-anonymity: your password is hashed locally and only the first 5 characters of the hash are sent, so the server can return matching breach records without ever learning your password. It's the same technique Have I Been Pwned pioneered.

The estimate is a range built on stated assumptions, not a guarantee. The key variable isn't the attacker's hardware anyway. It's how the stolen site stored your password. The same password that survives centuries under bcrypt can fall in hours if the site used fast, unsalted MD5. That's why the estimator shows both scenarios. You don't get to choose how the sites you use store passwords.

No. The generator creates passwords in your browser using the cryptographically secure random source built into it. Nothing is transmitted or logged. Copy it into your password manager, which is the only place it should live.

It analyzes the link itself: the real destination domain (which is often not the one displayed), lookalike characters, suspicious subdomain structures, and redirect layers. You paste the URL and never open it. It's a strong first read on a suspicious link, and combined with the sender's email headers it usually settles the question.

A freeze is the federally mandated, free option that blocks new credit checks at each bureau until you lift it. It's the strongest standard protection after a breach. A lock is a bureau's proprietary product that does something similar through their app, sometimes for a fee, under a contract rather than federal law. The credit freeze action plan walks through freezing at all three bureaus.

In descending order of strength: hardware security keys and passkeys (a fake login page can't use them), authenticator-app codes (strong, but a convincing fake page can trick you into typing one), and SMS codes (better than nothing, but vulnerable to SIM swapping). The 2FA planner ranks your specific accounts by what's available for each.

Key Terms

Entropy (bits): The measure of how unpredictable a password is. Each added bit doubles the number of guesses an attacker needs. A random 12-character mixed password has far more entropy than a longer one built from dictionary words and predictable substitutions.
bcrypt: A deliberately slow password-hashing algorithm designed to make mass guessing expensive. Sites that use bcrypt (or Argon2) make stolen password databases vastly harder to crack than sites using fast hashes like MD5 or SHA-1.
k-anonymity: A privacy technique where only a partial fingerprint (like the first 5 characters of a hash) is sent to a server, which returns all matches. The server never learns which exact item you were checking. Used here for breach lookups.
Passkey: A phishing-resistant login credential stored on your device and unlocked biometrically. Because it's cryptographically bound to the real website, a lookalike phishing site can't use it. That's the property SMS and app codes lack.
Credential stuffing: Taking username and password pairs leaked from one breach and automatically trying them on other services. It's why one reused password turns a single breach into a takeover of your email, bank, and social accounts.
SPF / DKIM: Email authentication records that let receiving servers verify a message really came from the domain it claims. Failures in these checks, visible in raw email headers, are among the clearest phishing signals.
Credit freeze: A free, federally guaranteed block on new credit checks at a bureau, preventing accounts from being opened in your name. Freezing at all three major bureaus is the standard first move after your identity data leaks.