Free tools that run only in your browser
Generate secrets, check and convert .env files, compare two environments, draft OIDC trust policies for CI, and build an offboarding checklist. Each tool runs on its own page, and what you paste stays in your browser.
About these tools: 6 tools5 framework presets
Runs in your browser. Nothing you type is sent anywhere.
Each tool is code on its own page. None of them makes network requests while you use it or stores anything in cookies or local storage, and they keep working if you go offline after the page loads.
Six tools for everyday secrets work
Each one does a single job, explains what it checks, and shows the command that does the same on your own machine.
Generate
Secret key generator
Random secrets in Base64, Base64URL, hex or letters and digits, from 128 to 512 bits, with a ready .env line.
- Uses crypto.getRandomValues
- Presets for Auth.js, Django, Rails, Laravel and JWT
- openssl command for each format
Check
.env linter
Finds lines that loaders read differently, values that run as commands when sourced, duplicates and values that look like real keys.
- 16 checks with line numbers
- The report never shows values
- Explains which loader does what
Convert
.env converter
Turns a .env file into JSON, YAML, a Docker --env-file or a systemd EnvironmentFile, and back again.
- Quotes each value the way the target format reads it
- Lists values a format can't hold
- Docker Compose environment block
Compare
Compare two .env files
Shows which variables exist in only one file and which have different values, with values hidden until you ask.
- Groups missing, different and identical variables
- Values stay masked by default
- Copies a report with names only
Build
OIDC trust policy builder
Trust policies and credentials for GitHub Actions, GitLab CI and Bitbucket Pipelines on AWS, Google Cloud and Azure, with the CI snippet.
- GitHub's new subject format with IDs
- AWS trust policy, Google attribute condition, Azure subject
- Warns about settings that are easy to get wrong
Plan
Offboarding checklist generator
Pick the services someone could reach and get an ordered checklist of what to close and which keys to reissue, with links.
- 19 services, 17 with a page to issue a new key
- Copy as Markdown or print
- Nothing is saved
Secret generator presets
The format each framework expects, what the secret protects, and how to change it without signing everyone out.
- Auth.js
AUTH_SECRETAUTH_SECRET for Auth.js, or NEXTAUTH_SECRET for NextAuth.js v4. - Django
SECRET_KEYSECRET_KEY in the alphabet of get_random_secret_key(), or letters and digits only. - Rails
SECRET_KEY_BASESECRET_KEY_BASE in the form bin/rails secret prints. - Laravel
APP_KEYAPP_KEY in the base64: format that key:generate writes. - JWT
JWT_SECRETHMAC keys for HS256, HS384 and HS512 at the sizes RFC 7518 requires.
Why only in the browser
A tool for secrets shouldn't need to see your secrets. These tools are code that runs on the page: no request leaves your browser while you type, nothing is saved, and once the page has loaded they keep working offline.
You can check it yourself. Open your browser's developer tools, switch to the Network tab and use any tool: nothing is sent. Our automated tests do the same on every change to the site: they type into each tool and fail if the page makes a single request.
Even so, if your rules say production secrets never leave your own machine, follow your rules. Every tool page lists commands that do the same job in a terminal.
When the values need a home
Crunu is a vault for your team's environment variables and keys. Values are encrypted on your devices, so the server stores them only as ciphertext. Free during early access.