Cryptographic Utilities, Network Tools & Privacy Scrubbers
Protect your digital identity, analyze network infrastructures, and verify cryptographic signatures with KitWharf's zero-knowledge security suite. From removing sensitive geolocation tags from photos before sharing to computing IPv4 CIDR blocks and generating cryptographically secure entropy, all algorithms execute locally without cloud telemetry.
Base64 & URL Encoder/Decoder
Encode and decode Base64 (standard & URL-safe) and URL percent-encoding with full Unicode support — instantly, with zero uploads.
SHA Hash Generator & UUID Creator
Generate SHA-1/256/384/512 digests from any text and mint bulk UUID v4 identifiers using your browser's Web Crypto API.
Password Generator
Generate strong, secure passwords with customizable length and character options (uppercase, lowercase, numbers, symbols).
JWT Encoder, Decoder & Debugger
Decode, verify, inspect, and generate JSON Web Tokens (JWT) in real time. Validate expiration timestamps, inspect payload claims, and test HMAC signatures locally.
Email & Message Header Analyzer
Trace RFC 5322 email delivery hops, calculate MTA transit latency delays, verify SPF, DKIM & DMARC authentication, and spot spoofing indicators.
SSL CSR Decoder & Validator
Decode and validate PKCS#10 Certificate Signing Requests (CSR). Verify Common Name, SAN domains, RSA/ECDSA key bit length, and signature security.
EXIF Metadata Viewer & Privacy Scrubber
Inspect hidden camera metadata, exposure settings, and GPS location coordinates. Scrub and sanitize EXIF data with 1-click.
User-Agent Parser & Device Inspector
Parse HTTP User-Agent strings, detect browser name and version, rendering engine, operating system, device form factor, CPU architecture, and web crawler bots.
Bcrypt Hash Generator & Verifier
Generate secure Bcrypt password hashes ($2a, $2b) with custom salt cost factors (4–14) and verify plaintext passwords against stored database hashes 100% in-browser.
Security & Privacy Architecture & Usage Guide
Cryptographic Integrity via Web Crypto API
Security tools should never ask you to trust a third-party server with your private keys, passwords, or network topology. KitWharf leverages the native browser Web Crypto API (SubtleCrypto) to generate true hardware-seeded entropy and compute standard SHA-256/SHA-512 cryptographic digests.
Whether you are diagnosing SPF/DKIM authentication failures in email headers or parsing ASN.1 DER-encoded SSL Certificate Signing Requests, all parsing occurs in-browser with zero external API dependencies.
Shielding Physical Location with Photo Sanitization
Modern smartphones automatically embed exact GPS latitude, longitude, camera serial numbers, and timestamps into photos. Sharing untouched photos online can expose your residence or workplace. Our EXIF Scrubber removes all metadata segments before you upload pictures to forums, marketplaces, or messaging channels.
Related Guides & Tutorials for Security & Privacy
Base64 Explained: What It Is, When to Use It, and When It's Wrong
Base64 is everywhere in web development — data URIs, JWTs, email attachments. Learn how the encoding actually works, when to use it, and why it is not encryption.
SHA-256, SHA-512, and UUIDs Explained: How Cryptographic Hashes and Identifiers Work
Learn how cryptographic hash functions like SHA-256 and SHA-512 work, why they are one-way, how checksums verify data integrity, and what makes UUID v4 statistically collision-proof.
What Actually Makes a Password Strong? Entropy, Length, and Common Myths
Look past outdated password rules. Learn why length trumps complex symbols, how brute-force attacks crack passwords, what password entropy means, and why client-side crypto generation matters.
JSON Web Tokens (JWT) Explained: How They Work, How to Decode Them, and Security Best Practices
Understand the inner mechanics of JSON Web Tokens (JWT). Learn how Header, Payload, and Signature connect, decode Base64URL claims, and avoid critical security vulnerabilities like the alg: none exploit.
Frequently Asked Questions
100% In-Browser Privacy
All security & privacy operate strictly inside your device memory. No files, code snippets, tokens, or personal inputs are ever sent to remote servers.