Quick security checks, right on your device

Password Generator

Create a strong random password using your browser's secure random number generator.

Password Strength & Leak Check

See how strong a password is, how long it might take to crack, and whether it has appeared in a known data breach. The password itself never leaves your browser.

Hash Generator

Get the SHA-1, SHA-256, SHA-384 and SHA-512 hash of text or a file, for example to check a download has not been changed.

Base64 / URL Encode & Decode

Convert text to and from Base64 or URL encoding. Supports all languages (UTF-8).

JWT Decoder

Decode a JSON Web Token to see its header, payload and expiry. Decoding happens in your browser; the signature is not verified.

Browser Inspector

This is the kind of information any website you visit can read about your browser and device.

What's My IP

See the public IP address and rough location that websites see when you visit them. This tool asks a free lookup service (ipapi.co, or ipify as a backup) and only runs when you click the button.

Passphrase Generator

A string of random words is easier to remember than a jumble of symbols and can be just as strong. Words are picked with your browser's secure random generator.

Email Security Checker

Check whether a domain is protected against attackers sending fake emails in its name. The domain is looked up through Cloudflare's public DNS service; nothing is sent to us.

Suspicious Link Checker

Paste a link from an email or message to check it for common phishing tricks. The link is examined in your browser and is never opened or sent anywhere.

Email Header Analyser

Paste the full headers of an email to see who really sent it, whether it passed the sender checks, and the servers it passed through. In Gmail use "Show original"; in Outlook use "View message source". Nothing leaves your browser.

Subnet Calculator

Enter an IPv4 address with a prefix (like 192.168.1.10/24) or with a subnet mask (like 10.0.0.5 255.255.255.0).

Email Breach Checker

See whether an email address appears in known data breaches, what was exposed, and what to do next. The address is checked against the free XposedOrNot breach database over an encrypted connection. Nothing is sent to Sampaati.

Breach data from XposedOrNot.

Company Breach Lookup

Enter a website address to see whether that company or service has had a publicly known data breach, when it happened and what was leaked. Uses the public breach list from Have I Been Pwned. Nothing is sent to Sampaati.

Breach data from Have I Been Pwned, licensed under CC BY 4.0.

CVE Lookup

Enter a vulnerability ID to see what it is, how severe it is, how likely it is to be exploited, and whether attackers are already using it. Data comes from the US National Vulnerability Database, FIRST's exploit prediction scores and CISA's list of exploited vulnerabilities.

Data from NVD, FIRST EPSS and CISA KEV.

Website Security Grade

Get an A+ to F grade for a website's security settings, such as HTTPS, security headers and safe cookies. The scan is run by Mozilla Observatory, so the website address is sent to Mozilla. Nothing is sent to Sampaati.

Scan by Mozilla Observatory.

QR Code Scam Check

Scammers stick fake QR codes on parking meters, posters and shop counters, or send them on WhatsApp. Choose a photo or screenshot of a QR code to see where it really leads, or who a UPI payment would go to, without opening it. The image is read on your device and never uploaded.