Privacy & Security Tools
Strip location data from photos, encrypt files with a password, test password strength and verify downloads, with the browser's own cryptography, on your device. These are the tools where "no upload" isn't a feature; it's the entire point.
- Image Metadata Remover See what hidden data your photo carries, EXIF, GPS coordinates, editing history, and download a clean copy, without the image ever leaving your device.
- File Encryption Tool Password-protect any file with AES-256-GCM, the same cipher class protecting your bank connection, entirely on your device.
- Password Strength Checker An honest strength check: entropy math plus the pattern warnings that matter, because "Summer2026!" passes complexity rules and falls in seconds.
- File Hash Checker Drop in a file, get its SHA-256 fingerprint, paste the publisher's checksum, matching hashes prove the download arrived bit-for-bit intact.
- PII Redactor Paste text and the tool finds and masks personal data, emails, phones, SSNs, cards, IPs and IBANs, so you can safely share it without leaking it.
- TOTP Authenticator Code Generator Paste a Base32 TOTP secret to see the current 6-digit two-factor code with a live countdown, computed on your device, never sent anywhere.
- Bcrypt Hash Generator & Verifier Generate a bcrypt password hash, or check a password against a $2b$ hash, computed locally, the password never leaves your device.
- File Type Identifier (Magic Bytes) Drop in a file to see what it really is from its signature bytes, and get a warning when a file's extension doesn't match its actual content.
- X.509 Certificate Decoder (PEM) Paste a PEM certificate to see who it's for, who issued it, when it expires, its key and its SAN domains, parsed locally on your device.
Privacy tools that practise what they preach
A privacy tool that uploads your data isn't a privacy tool. Here, metadata cleaning, encryption, checksums and password utilities all run in your browser. Strip the hidden EXIF from a photo (GPS coordinates, camera serial, timestamps) before you share it; encrypt or decrypt a file locally; verify a download's checksum; or generate and assess a strong passphrase, none of it leaving your device.
That's the whole point: the sensitive input never reaches a server, so there's nothing to intercept, log or leak. Everything is computed with the browser's own cryptography and works offline.
Frequently asked questions
Why must security tools especially run client-side?
Because their inputs are the crown jewels: passwords, private photos, files worth encrypting. A "free online encryptor" that uploads your file has defeated its own purpose before it starts. Every tool here runs in your browser, verify by disconnecting from the internet.
Is browser cryptography real cryptography?
Yes, the Web Crypto API exposes the browser's native, audited implementations of AES-GCM, SHA-2 and PBKDF2, the same primitives TLS uses. It is not a JavaScript re-implementation; the browser calls the operating system's crypto libraries.
Can LazyTools recover an encrypted file or see my password?
No. There is no server component, no account, and no telemetry on inputs. That cuts both ways: a forgotten encryption password means the data is unrecoverable by anyone, including us.