Security Tools
DNSX Security Tools are four free web utilities for handling credentials: a random password generator, a Diceware passphrase generator, a hash generator covering MD5, SHA-1, SHA-256, SHA-512 and bcrypt, and a one-time secret link that is encrypted in your browser and destroyed once its view limit is reached. No account, no ads, no tracking cookies.
Password Generator
Generate cryptographically secure random passwords with customizable length and character sets.
Passphrase Generator
Create memorable yet secure passphrases using random words that are easier to remember.
Hash Generator
Generate MD5, SHA-1, SHA-256, SHA-512, and bcrypt hashes for any text input.
One-Time Secret
Share sensitive information securely with self-destructing encrypted messages.
How do I use these tools from the command line?
Which security tool do I need?
Pick by what you are trying to do with the credential, not by algorithm:
| If you need to… | Use | Why |
|---|---|---|
| Create a credential you will never type from memory | Password Generator | Maximum entropy per character. Store it in a password manager. |
| Create a credential you must type from memory (a master password, a disk-encryption key) | Passphrase Generator | Whole words are far easier to memorise and type accurately at the same strength. |
| Verify a download, compare a checksum, or see what a password hash looks like | Hash Generator | MD5, SHA-1, SHA-256, SHA-512 and bcrypt computed side by side from one input. |
| Send an existing credential to another person | One-Time Secret | The link stops working once its view limit is used, so the secret never sits in a mailbox or chat history. |
Where do these tools run, and what is stored?
Password, passphrase and hash generation run on the DNSX server, using Go's crypto/rand as the entropy source, which reads from the operating system CSPRNG. The generated value is returned over TLS and is not written to disk or to a log. This is stated plainly because several competing generators claim browser-only generation while doing the same thing.
The one-time secret tool works the other way round. Your plaintext is encrypted in your browser with AES-256-GCM, and the key is placed in the URL fragment after the #, which browsers never transmit to a server. DNSX stores only ciphertext it has no key for, and destroys it once the link has been opened as many times as you allowed (one view by default) or its expiry passes.
No tool here requires an account, sets a tracking cookie, or serves an advertisement.
Network Diagnostic Tools
DNS Lookup
Query A, MX, TXT, CNAME, NS, and more from multiple DNS resolvers.
IP Lookup
Get geolocation, ASN, and registration data for any IP address.
SSL Checker
Check SSL/TLS certificates, expiration dates, and certificate chains.
WHOIS Lookup
Find domain registration info, registrar details, and nameservers.
Email Tools
Check MX, SPF, DMARC, and DKIM configuration for email deliverability.