DevStack

Category guide

Security

Hash a password with bcrypt, checksum text or a file, look up a public IP address, read a domain registration, list published host names, read a certificate, or check the security headers on a public site. Use these only on secrets and hosts you are allowed to review.

Made for: Developers checking a password hash, and operators reviewing a public host or domain they own or assess.

Tools in this category

Password Hash Alpha

Generate a bcrypt hash and check it against the original text.

Multi-Algorithm Hash Generator

Hash text or a file as MD5, SHA-256, and SHA-512, then match a pasted digest.

Subdomain Finder

List published host names for a domain and their public addresses.

SSL/TLS Certificate Checker

Read the certificate a public host presents and see when it expires.

Load Sample

Time a short burst of GET requests and read the average response and throughput.

CORS Tester

See whether a frontend origin is allowed to read an API response.

HTTP Security Headers Analyzer

Check whether a public site sends the headers that limit scripts, framing, and content sniffing.

Whois Lookup

Read the public registration record for a domain: registrar, dates, and name servers.

IP & GeoIP Lookup

See the estimated location, ISP, and network record for a public IP address or domain.

Typical workflow

  1. 01

    Choose the check

    Password Hash creates or verifies a bcrypt hash. Multi-Algorithm Hash Generator returns MD5, SHA-256, and SHA-512 for text or a file. IP & GeoIP Lookup reads the location and network record for a public address. Whois Lookup reads the registrar, dates, and name servers. Subdomain Finder lists published host names. SSL/TLS Certificate Checker reads the certificate from one handshake. HTTP Security Headers Analyzer reads the response headers from one request.

  2. 02

    Enter only what you may process

    Type a password you are allowed to hash, or a domain you are reviewing. The finder does not guess a private word list.

  3. 03

    Run it

    Set the bcrypt cost, or start the scan. A higher cost is slower. The scan reads certificate transparency logs.

  4. 04

    Use the output carefully

    Copy the hash, or export the host table as CSV or JSON. Treat the host list as public information, not a full security audit.

Best practices

  • MD5, SHA-256, and SHA-512 are checksums. Use Password Hash when the value needs bcrypt.
  • Bcrypt only uses the first 72 bytes of the password. A longer passphrase is truncated.
  • Twelve rounds is the usual starting cost. Raise it only if the extra delay is acceptable.
  • Subdomain Finder returns at most 120 names from certificate transparency. It is not a brute-force scan.
  • The certificate checker opens one TLS 1.2 connection to a public host. It does not test ciphers for weaknesses.
  • The header analyzer reads response headers only. A missing header is a gap to review, not proof that a page can be attacked.
  • GeoIP shows the network’s recorded area. It is not a precise location of a person or device.
  • Whois reads the public registration record. It does not reveal an owner the registrar has redacted.
  • An orange cloud means the address is in Cloudflare’s published ranges.

Privacy & limits

Password hashing is processed on the DevStack API. Subdomain scans and certificate checks are not stored. Do not submit passwords or hosts you are not allowed to check.

Frequently asked questions

Does Password Hash store the password?

The tool returns a bcrypt hash or a match result. Do not use it for passwords you cannot send to the API.

Where do the subdomains come from?

Host names already published in certificate transparency logs, then resolved to a public IPv4 address.

Ready to try Security tools?

Open the category to launch any tool.

Open Security