# Free online tools - Maurizio Fonte

> 50+ free, privacy-first developer / security / utility tools. Everything runs client-side in the browser: no upload, no signup, no expiry. By Maurizio Fonte, senior backend engineer (mauriziofonte.it).

Each tool also serves a Markdown mirror of its documentation at the same URL with a `.md` suffix (ideal for LLM consumption).

## Tools

- [120 random passwords for servers, master keys, admin accounts](https://www.mauriziofonte.it/tools/password-generator): Online secure password generator free: 120 strong passwords from 10 to 32 characters, ASCII or alphanumeric. Generated via OS CSPRNG. Click to copy. [markdown](https://www.mauriziofonte.it/tools/password-generator.md)
- [From ASCII bytes to CJK ideograms: reversible encoding](https://www.mauriziofonte.it/tools/mojibake): Online steganography tool free based on mojibake: each byte is mapped to a higher Unicode codepoint at random. Illegible at glance, fully reversible. [markdown](https://www.mauriziofonte.it/tools/mojibake.md)
- [Guaranteed unique solution: from Beginner to Expert](https://www.mauriziofonte.it/tools/sudoku): Play sudoku online free with real-time generator and 5 levels (Beginner, Easy, Medium, Hard, Expert). Timer, hints, statistics, pencil-mark mode. [markdown](https://www.mauriziofonte.it/tools/sudoku.md)
- [OWASP and NIS2 art. 24 compliance for response headers](https://www.mauriziofonte.it/tools/http-security-headers-analyzer): Online HTTP response headers analyzer free: CSP, HSTS, X-Frame, Referrer-Policy, Permissions-Policy, COOP/COEP/CORP. Mapped to NIS2 art. 24 and OWASP. [markdown](https://www.mauriziofonte.it/tools/http-security-headers-analyzer.md)
- [OWASP JWT: brute-force 10,000 secrets + kid injection](https://www.mauriziofonte.it/tools/jwt-security-audit): Online JWT token audit free: alg=none, brute-force on 10,000 known HS256 secrets, alg confusion, missing claims, kid injection, unpinned jku/x5u. No upload. [markdown](https://www.mauriziofonte.it/tools/jwt-security-audit.md)
- [Find vulnerabilities in web servers: 30+ hardening checks](https://www.mauriziofonte.it/tools/apache-nginx-config-linter): Online Apache and Nginx config linter free (.htaccess, vhost, server): 30+ checks on SSL/TLS, CSP, HSTS, Permissions-Policy, WAF. No upload. [markdown](https://www.mauriziofonte.it/tools/apache-nginx-config-linter.md)
- [PHP supply chain: scan 6,000+ advisories every night](https://www.mauriziofonte.it/tools/composer-security-audit): Online audit of composer.json/lock for PHP: CVE with CVSS, EOL frameworks, abandoned packages. Dataset of 6,000+ advisories rebuilt nightly. No upload. [markdown](https://www.mauriziofonte.it/tools/composer-security-audit.md)
- [From API JSON to TypeScript interface in one click](https://www.mauriziofonte.it/tools/json-formatter): Online JSON formatter free: validate, minify, sort keys and generate TypeScript interfaces from JSON. All in your browser, no upload, no size limit. [markdown](https://www.mauriziofonte.it/tools/json-formatter.md)
- [From image to Base64 and JWT to JSON: 6 conversions in browser](https://www.mauriziofonte.it/tools/encoder-decoder-online): 6 online encoders and decoders free: Base64 (RFC 4648), URL (RFC 3986), HTML entities, JWT decode, Unicode escape, image to Data URI. [markdown](https://www.mauriziofonte.it/tools/encoder-decoder-online.md)
- [From epoch to UTC, US, EU, Asia and AU: DST automatic](https://www.mauriziofonte.it/tools/unix-timestamp-converter): Online Unix timestamp converter free: epoch ↔ ISO 8601 with live readout across multiple timezones (UTC, US, EU, Asia, AU). DST automatic, batch CSV. [markdown](https://www.mauriziofonte.it/tools/unix-timestamp-converter.md)
- [File checksum up to 100 MB with MD5, SHA-256, BLAKE2 + 15 more](https://www.mauriziofonte.it/tools/hash-calculator): Online hash calculator free for text or files up to 100 MB with 18 algorithms: MD5, SHA-1, SHA-2, SHA-3, BLAKE2, RIPEMD, CRC, xxHash, MurmurHash3. No upload. [markdown](https://www.mauriziofonte.it/tools/hash-calculator.md)
- [10,000 IDs per call in CSV or JSON: bulk for DB seeding](https://www.mauriziofonte.it/tools/uuid-ulid-generator): Online UUID generator free: v4 (random), v7 (time-ordered RFC 9562), v5 (namespace), ULID, NanoID. Bulk up to 10,000 IDs per call, CSV or JSON export. [markdown](https://www.mauriziofonte.it/tools/uuid-ulid-generator.md)
- [From title to URL: città → citta-di-torino, perché → perche](https://www.mauriziofonte.it/tools/slug-generator): Online URL slug generator free from Italian (proper accents), Spanish, French, German, English. Diacritic transliteration, batch CSV, configurable separator. [markdown](https://www.mauriziofonte.it/tools/slug-generator.md)
- [From HEX to OKLCH: accessible palettes and WCAG 2.1 contrast](https://www.mauriziofonte.it/tools/color-picker-converter): Online color picker free: bidirectional HEX/RGB/HSL/OKLCH/Lab conversions and WCAG 2.1 contrast checker (AA/AAA). OKLCH accessible palette generator. [markdown](https://www.mauriziofonte.it/tools/color-picker-converter.md)
- [Static QR codes with no redirect: EPC069-12 and vCard 4.0](https://www.mauriziofonte.it/tools/qr-code-generator): Online QR code generator free for URLs, Wi-Fi, vCard 4.0, text, SEPA wire transfers in EPC069-12 (with IBAN validation). PNG and SVG export, center logo. [markdown](https://www.mauriziofonte.it/tools/qr-code-generator.md)
- [5 filler styles: from classic Cicero to geek with emoji](https://www.mauriziofonte.it/tools/lorem-ipsum-generator): Online Lorem Ipsum generator free in 5 styles: classic Cicero, original Cicero passage, contemporary Italian, geek/dev tech-flavored, emoji. Optional HTML wrap. [markdown](https://www.mauriziofonte.it/tools/lorem-ipsum-generator.md)
- [Code review and propagation across git branches](https://www.mauriziofonte.it/tools/text-diff-online): Online side-by-side diff free for text and JSON with Myers algorithm: 4 modes (lines, words, chars, JSON struct), export as unified patch diff -u. [markdown](https://www.mauriziofonte.it/tools/text-diff-online.md)
- [From UPPERCASE to camelCase: 14 case formats locale-aware](https://www.mauriziofonte.it/tools/text-case-converter): Online text case converter free: 14 formats including UPPERCASE, lowercase, camelCase, snake_case, kebab-case, PascalCase. Locale-aware accents. [markdown](https://www.mauriziofonte.it/tools/text-case-converter.md)
- [For multi-stack: pyproject.toml, k8s YAML, GitHub Actions](https://www.mauriziofonte.it/tools/yaml-json-toml-converter): Online YAML ↔ JSON ↔ TOML converter free, bidirectional: source format auto-detect, strict validation with error position, instant I/O swap. [markdown](https://www.mauriziofonte.it/tools/yaml-json-toml-converter.md)
- [Import CSV from Excel or Sheets to JSON with type casting](https://www.mauriziofonte.it/tools/csv-to-json-converter): Online CSV/TSV ↔ JSON converter free, bidirectional: RFC 4180 parser, delimiter auto-detect (comma, tab, pipe), type casting (int/float/bool). [markdown](https://www.mauriziofonte.it/tools/csv-to-json-converter.md)
- [From MySQL to Oracle PL/SQL: 13 dialects, keyword case, minify](https://www.mauriziofonte.it/tools/sql-formatter): Online SQL formatter free in 13 dialects: MySQL, Postgres, SQLite, T-SQL, BigQuery, Snowflake, Trino, Oracle. Indent, keyword case, minify. [markdown](https://www.mauriziofonte.it/tools/sql-formatter.md)
- [Compression up to 70% with byte savings stats](https://www.mauriziofonte.it/tools/html-css-js-minifier): Online minifier and beautifier free for HTML, CSS, JSON, XML. Typical 30-50% size reduction on HTML/CSS, up to 70% on JSON. Preserves whitespace in pre/script. [markdown](https://www.mauriziofonte.it/tools/html-css-js-minifier.md)
- [Realtime exchange rates: 165+ fiat and 130+ crypto](https://www.mauriziofonte.it/tools/currency-converter): Convert Currencies Online, updated to today's rates. Convert USD to EUR or BTC to USD. 297 assets across 165+ fiat (EUR, USD, GBP) and 130+ crypto (BTC, ETH). [markdown](https://www.mauriziofonte.it/tools/currency-converter.md)
- [Email deliverability audit: find DNS issues in 5 minutes](https://www.mauriziofonte.it/tools/email-dns-validator): Online SPF, DKIM, DMARC validator free + MX lookup via DoH + 6-way multi-resolver compare (Cloudflare, Google, AliDNS, dns.sb) for email deliverability. [markdown](https://www.mauriziofonte.it/tools/email-dns-validator.md)
- [Read a JWT without sending it to a server: claims and expiry](https://www.mauriziofonte.it/tools/jwt-decoder): Online JWT decoder free with header/payload/signature split, JSON parsing, RFC 7519 claim explainer (iss, sub, exp, iat), expiry countdown, HS256 verify. [markdown](https://www.mauriziofonte.it/tools/jwt-decoder.md)
- [Crontab in plain English: Unix, GitHub Actions, Kubernetes, Quartz](https://www.mauriziofonte.it/tools/cron-expression-parser): Online cron parser free with natural language explanation, weekly visualizer and next 20 runs in a timezone of your choice. Supports POSIX 5-field, Quartz 6-field (seconds), @daily aliases, GitHub Actions, Kubernetes CronJob. [markdown](https://www.mauriziofonte.it/tools/cron-expression-parser.md)
- [Build, test and debug regex with capture groups in real time](https://www.mauriziofonte.it/tools/regex-tester): Online JavaScript regex tester free with live highlight, capture groups, gimsuy flags. Pattern library: email, URL, IP, phone, dates, hex color, slug, ISO. [markdown](https://www.mauriziofonte.it/tools/regex-tester.md)
- [What does 404, 500, 301 mean: HTTP status codes explained](https://www.mauriziofonte.it/tools/http-status-codes): Online HTTP status codes reference free (RFC 9110, 1xx-5xx): name, semantics, when to use, when NOT to use, curl example. Search by code or category. [markdown](https://www.mauriziofonte.it/tools/http-status-codes.md)
- [Markdown ↔ HTML round-trip: live preview and GFM pipe tables](https://www.mauriziofonte.it/tools/markdown-html-converter): Online Markdown ↔ HTML converter free, bidirectional. GFM subset: heading, bold, link, images, fenced code blocks, lists, blockquote, pipe tables. [markdown](https://www.mauriziofonte.it/tools/markdown-html-converter.md)
- [From API response to types: TS interface, Go struct, PHP class](https://www.mauriziofonte.it/tools/json-to-typescript-go-php): Generate TypeScript, Go struct, PHP class from JSON online. Automatic type inference with nested objects, array element, optional/nullable detection. [markdown](https://www.mauriziofonte.it/tools/json-to-typescript-go-php.md)
- [Multi-locale faker: real names and cities for DB seeding](https://www.mauriziofonte.it/tools/mock-data-generator): Online mock data generator free for testing: 5 locales (it/en/es/de/fr), custom schema (name, email, UUID, date), output JSON, CSV, SQL INSERT. [markdown](https://www.mauriziofonte.it/tools/mock-data-generator.md)
- [From HTML head to 4 social cards: also on staging and localhost](https://www.mauriziofonte.it/tools/social-meta-tag-preview): Online OpenGraph and Twitter Cards preview free: see how Facebook, X, LinkedIn and Discord render your page. Audit of essential meta tags included. [markdown](https://www.mauriziofonte.it/tools/social-meta-tag-preview.md)
- [Compile glob to regex: gitignore, npmignore, dockerignore](https://www.mauriziofonte.it/tools/glob-pattern-tester): Online glob pattern tester free (* ** ? [abc] {a,b}) against a path list. Compatible with .gitignore, .npmignore, .dockerignore. Shows compiled regex. [markdown](https://www.mauriziofonte.it/tools/glob-pattern-tester.md)
- [Dig online via DoH: A, MX, TXT from mobile or restricted nets](https://www.mauriziofonte.it/tools/dns-over-https-tester): Online DoH tester free with 6 selectable resolvers (Cloudflare, Google, AliDNS, dns.sb): query A, AAAA, CNAME, MX, TXT, NS, SOA, CAA, PTR, SRV and cross-compare to spot filtered answers. [markdown](https://www.mauriziofonte.it/tools/dns-over-https-tester.md)
- [Encrypt and decrypt text and files with AES-256-GCM](https://www.mauriziofonte.it/tools/aes-encrypt-decrypt): Encrypt and decrypt text or files with AES-256-GCM and a password, entirely in your browser. Key derived with PBKDF2, random salt and IV. No upload, nothing sent to a server. [markdown](https://www.mauriziofonte.it/tools/aes-encrypt-decrypt.md)
- [Perceptual image hashing and compare by Hamming distance](https://www.mauriziofonte.it/tools/image-perceptual-hash): Compute the perceptual hash (aHash, dHash, pHash) of an image and compare two images with the Hamming distance. All in your browser, no upload. [markdown](https://www.mauriziofonte.it/tools/image-perceptual-hash.md)
- [View the EXIF metadata of multiple photos, with GPS and SHA-256](https://www.mauriziofonte.it/tools/exif-metadata-viewer): Extract and view the EXIF metadata of one or more photos (camera, shot, date, GPS), plus a forensic SHA-256. Values translated to readable form. No upload. [markdown](https://www.mauriziofonte.it/tools/exif-metadata-viewer.md)
- [Read a QR Code from an image or a screenshot](https://www.mauriziofonte.it/tools/qr-code-reader): Decode a QR Code from an image or screenshot right in your browser. Recognises URL, Wi-Fi, vCard, SEPA and text. No upload, nothing sent to a server. [markdown](https://www.mauriziofonte.it/tools/qr-code-reader.md)
- [Convert and resize images between PNG, JPEG, WebP, AVIF](https://www.mauriziofonte.it/tools/image-converter): Convert images between PNG, JPEG, WebP and AVIF and resize them, right in your browser. Quality and file-size control. No upload, nothing sent to a server. [markdown](https://www.mauriziofonte.it/tools/image-converter.md)
- [Extract the hidden metadata of a PDF file](https://www.mauriziofonte.it/tools/pdf-metadata-viewer): View a PDF file's metadata (title, author, authoring software, dates, page count, encryption) right in your browser. No upload, nothing sent to a server. [markdown](https://www.mauriziofonte.it/tools/pdf-metadata-viewer.md)
- [Is your ad blocker actually working?](https://www.mauriziofonte.it/tools/adblock-test): A free, safe test to find out if your ad blocker really works. It checks ads and trackers across 50+ real services, including the telemetry of Xiaomi, Samsung, Oppo, Huawei and Apple phones. It also shows which DNS you're using. Works with uBlock Origin, AdGuard, Pi-hole, NextDNS and Brave. No data collected: the test runs entirely in your browser. [markdown](https://www.mauriziofonte.it/tools/adblock-test.md)
- [Decode and inspect SSL/x509 certificates in your browser](https://www.mauriziofonte.it/tools/ssl-certificate-decoder): Decode an SSL/x509 certificate in PEM format right in your browser: Subject, SAN, Issuer, expiry, serial number, public key and SHA-256/SHA-1 fingerprint. [markdown](https://www.mauriziofonte.it/tools/ssl-certificate-decoder.md)
- [Build an XSS-proof CSP, or validate the one you already ship](https://www.mauriziofonte.it/tools/csp-generator-validator): Online Content-Security-Policy builder and validator: compose an XSS-safe CSP header by directive, or audit an existing policy. Fully client-side, free. [markdown](https://www.mauriziofonte.it/tools/csp-generator-validator.md)
- [Generate and verify bcrypt and Argon2id password hashes, in your browser](https://www.mauriziofonte.it/tools/bcrypt-argon2-hash-generator): Generate and verify bcrypt ($2y$) and Argon2id password hashes in your browser: adjustable cost factor, automatic salt, no upload. Why not to use MD5 or SHA for passwords. [markdown](https://www.mauriziofonte.it/tools/bcrypt-argon2-hash-generator.md)
- [From cURL command to code: fetch, PHP cURL, Python requests, Node](https://www.mauriziofonte.it/tools/curl-to-code-converter): Convert a cURL command into fetch JavaScript, PHP cURL, Python requests or Node code. Handles method, headers, JSON body, bearer token, basic auth, cookies and multipart form. Client-side. [markdown](https://www.mauriziofonte.it/tools/curl-to-code-converter.md)

## Other languages

- Italiano: https://www.mauriziofonte.it/strumenti/llms.txt