Sign in Create account
AuthBeta
Sign in Create account

Guides

Short, practical notes on getting the most out of each tool.

2FA codes

Works with any authenticator secret: typed, scanned from an image, or pasted as base64 data.

Three ways to feed in a secret

  1. Secret or link: paste the base32 key (JBSWY3DPEHPK3PXP), a full otpauth:// link, or even a whole block of text that contains one. The key is picked out for you.
  2. QR image: click the drop area, drag an image in, or press Ctrl+V anywhere on the page after taking a screenshot.
  3. Base64 data: paste the raw data:image/png;base64 string that many sites put on the clipboard when you choose "copy image".

Where the work happens

Browsers that ship the BarcodeDetector API (Chrome, Edge, Opera) read the QR code locally: the picture never leaves your machine, only the decoded text is sent so the server can compute the code. Other browsers fall back to server-side decoding over HTTPS.

Supported parameters

Setting Values Default
Digits4 – 106
Period1 – 600 seconds30
AlgorithmSHA-1, SHA-256, SHA-512, SteamSHA-1
TypeTOTP, HOTPTOTP

Recent on this browser

Every code you generate is kept for 3 days without any sign-in. Recognition works in three layers: a long-lived cookie, a copy of the same id in localStorage for when cookies get cleared, and a soft fingerprint (browser, language, IP network) to reconnect a device that lost both.

Secrets in the history are encrypted with AES-256-GCM before they touch the database, and rows older than the retention window are deleted automatically. Clearing the history removes them immediately.

When you sign in on a browser that already has history, you are asked whether to move those codes into your account. It never happens on its own, since the computer may be shared. Account history is kept 3 days.

i Private browsing windows look like a brand new device every time, so the history will not follow you there.

Password generator

Everything is generated with a cryptographically secure random source. Your settings are remembered on this browser for six months.

Mode Good for
RandomAnything stored in a password manager. Maximum entropy per character.
MemorableThe handful of passwords you type by hand: device unlock, disk encryption.
PINNumeric codes for phones, SIM cards, alarm panels.
Hex / Base64API secrets, encryption keys, seeds for other systems.
UUID v4Identifiers, not secrets: 122 bits of randomness in a standard shape.

Your options are remembered on this browser for 180 days, and follow your account once you sign in.

Text tools

Paste a list, choose an operation, get the result. Everything runs on demand and nothing is stored.

Bulk 2FA codes

Paste one entry per line. All of these work:

JBSWY3DPEHPK3PXP
github|JBSWY3DPEHPK3PXP
[email protected]|hunter2|JBSWY3DPEHPK3PXP
otpauth://totp/GitHub:[email protected]?secret=JBSWY3DPEHPK3PXP&issuer=GitHub

The separator is detected automatically, and the longest valid base32 field on the line is treated as the secret, so account lists with a password column in the middle still work. Results export to CSV.

IP & DNS

  • IP lookup: version, type, reverse DNS, and geolocation with a map when enabled.
  • DNS records: A, AAAA, MX, NS, TXT, SOA, CNAME and CAA with their TTLs.
  • WHOIS: asks IANA which server owns the TLD, then queries it and the registrar.
  • Port check: open or closed, by TCP connection (16 ports per run) or by UDP probe carrying a real service payload (10 ports per run).
  • TCP latency: TCP handshake timing, because PHP cannot send ICMP pings without root.
  • Spam blacklists: checks an IPv4 address against six well known DNSBLs.
  • Mail security: SPF, DMARC, MX, MTA-STS and TLS-RPT records for a domain.
  • WebRTC leak: shows whether your browser leaks your real IP address through WebRTC. This matters when you use a VPN: if it says Leaking, your real address is showing even with the VPN on.

2FA vault

Secrets are encrypted before they are stored. QR images are never kept, only the text they contain.

  • Add entries by pasting a secret or an otpauth link, or straight from a QR image.
  • Images are converted to text on the spot: the picture itself is never stored.
  • Export a QR at any time to move an account onto a new phone.
  • Back up to otpauth text, JSON or CSV; import accepts all three plus plain secrets.
  • Revealing a secret asks for your password again.

Password vault

Your logins, encrypted before they are stored. Only you can read them back.

  • Passwords, notes and any attached 2FA secret are encrypted with AES-256-GCM before they are stored.
  • The list only shows a few characters at each end so you can recognise an entry, never the password itself.
  • Copy puts the password on the clipboard without showing it; revealing it asks for your account password again.
  • Each entry can carry its own 2FA secret, and then the six-digit code appears next to the password.
  • A summary panel counts weak passwords, ones reused from another entry, and ones untouched for over a year.
  • Imports CSV files exported from Chrome, Firefox, Bitwarden, LastPass or 1Password: their column names are recognised automatically.
⚠ Exporting produces a file with the passwords in plain text, so it asks for your password first. Delete the file as soon as you are done with it.

What each tool does

The full list of 35 tools, grouped by the job you are doing. It is built from the tool catalogue in the source, so it never drifts from the running version. Most compute entirely on this server and keep working with the Internet down; the ones that must ask outside are listed in full in the Privacy policy.

Security & authentication

Read and build standards-shaped things: TOTP codes per RFC 6238, JWTs split into three parts with expiry, QR codes read from an image or built fresh. No secret leaves this server.

  • 2FA codes , Paste a secret or a QR image and get the 2FA code.
  • Code reader , Read QR codes from an image or straight from the camera. · Guide
  • Password generator , Generate strong passwords and score their strength.
  • JWT decoder , Split a JWT into three parts, read the claims and check the signature. · Guide
  • Pwned password check , Check whether a password or email shows up in known data breaches. The password never leaves your device. · Guide
  • Encrypt text , Encrypt a message with a password before sending it over chat. Everything runs in your browser. · Guide
  • File checksum , Compute MD5, SHA-1, SHA-256 and SHA-512 for a file and compare with the publisher's hash. The file never leaves your device. · Guide
  • QR generator , Create a QR code from any text or link. · Guide

Network & domains

IPv4 and IPv6 subnetting (mask, range, broadcast, VLSM, CIDR aggregation, arbitrary range to CIDR), MAC vendor lookup against the IEEE tables kept on disk, EUI-64 construction, and decoding of IPv6 addresses with IPv4 embedded, 6to4, Teredo, NAT64.

  • IP lookup , See your own IP and look up any address.
  • DNS records , Look up A, AAAA, MX, TXT and NS records for a domain.
  • Subnet & CIDR , Work out IPv4/IPv6 blocks: mask, host range, subnetting. · Guide
  • MAC lookup , Find the vendor behind a MAC address, reformat it, build the EUI-64. · Guide
  • WHOIS , Who registered this domain or IP range, and until when.
  • Port check , Probe common TCP/UDP ports to see which are open.
  • TCP latency , Measure latency to a host with a TCP handshake.
  • Proxy checker , Check whether HTTP, SOCKS4 and SOCKS5 proxies are alive and how well they hide your address. · Guide
  • SSL/TLS check , Inspect a TLS certificate: days left, name match, and which TLS versions the server takes. · Guide
  • Reverse IP lookup , Find the domains that point at one IP address. · Guide
  • Link preview , See how a link looks when shared on social media and chat apps, and which tags are missing. · Guide
  • Redirect tracer , See every page a link passes through before it lands, especially a short link. · Guide
  • ASN & IP range lookup , Look up the ASN, network owner and every IP range of an address, domain or organisation. · Guide
  • Email header analyzer , Paste an email’s raw headers to see its route, SPF, DKIM, DMARC results and phishing signs. · Guide
  • Spam blacklists , Check whether an address sits on anti-spam blocklists.
  • Mail security , Check a domain SPF, DMARC, MX and MTA-STS records.

Conversion & calculation

Number bases alongside how a machine actually stores the value: two’s complement, one’s complement, sign-magnitude, excess-K, IEEE 754 half/single/double, byte order, Base32/58/64/85. Unit conversion across 232 units. Date arithmetic, cron expressions read back in plain words, and colour conversion through sRGB, HSL, OKLCH and CIE Lab with WCAG contrast checks. Convert currencies at market rates refreshed every minute, with bank buy and sell prices for VND.

Data & text

Clean and transform text line by line, generate UUID v1/v3/v4/v5/v7 and ULID identifiers, hash, and encode or decode the common formats.

  • Text tools , Sort, filter, encode and hash text in bulk.
  • ID generator , Generate UUIDs, ULIDs and Nano IDs, or inspect an existing one. · Guide
  • Cron reader , Explain a cron expression and list its next runs. · Guide

Device testing

Test keyboards, speakers, headphones and microphones right in the browser: which keys are dead, which channel is silent, whether the mic distorts or hisses. Keystrokes and audio never leave your device.

  • Keyboard tester , Press each key to see which ones work, which are dead, double-typing or stuck. Also measures how many keys register at once. · Guide
  • Speaker & headphone test , Check left and right channels, reversed wiring, and sweep from bass to treble to find rattles. Includes a step-by-step auto test. · Guide
  • Microphone test , See whether your mic picks up too loud or too quiet, distorts, hisses or hums, with waveform, spectrum and a record-and-play-back check. Includes a 9-second auto test. · Guide

Each tool accepts several ways of writing the same thing, Cisco-style MAC addresses, inverted netmasks, 0x-prefixed numbers, dates written in words, so in most cases you can paste and go.

Tool guides

How to use each tool, how to read the result, and what's good to know.

Code reader

  1. Allow camera access, or paste a screenshot of the QR code into the page.
  2. Hold the code in the middle of the frame until it's read.
  3. Copy the result. Switch camera if your device has more than one.

Good to know: Images are read in your browser. Don't rush to open unfamiliar links from a QR code.

JWT decoder

  1. Paste the JWT into the Token box.
  2. To check the signature, enter the secret key. Otherwise leave it empty.
  3. Press the read button to see the header, the payload and the expiry.

Good to know: Don't paste live production tokens into any website, this one included.

Pwned password check

  1. Choose Password or Email address.
  2. Type the password (or email) and press Check.
  3. If the password was exposed, change it everywhere you use it. If the email shows up in breaches, change your password on the sites listed.

Reading the result: "Times exposed" is how often this password appears in leaked data. Once is enough for attackers to put it on the list they try first.

Good to know: Your password never leaves your device. Email lookups are different: the address is sent to XposedOrNot.

Encrypt text

  1. Choose Encrypt, type what you want to keep private and a password, or press Generate.
  2. Press Encrypt, then copy the text starting with ABE1. and send it over chat.
  3. Tell the recipient the password another way, for example by phone. They open this page, choose Decrypt, paste the text and enter the password.

Reading the result: A wrong-password error means either the password was mistyped or part of the text got lost while copying.

Good to know: Forget the password and the message is gone; this site can't recover it either. Neither the message nor the password is sent to the server.

File checksum

  1. Drop a file into the box, or click to choose one.
  2. Paste the checksum published on the download page into the compare box. The tool works out whether it's MD5, SHA-1, SHA-256 or SHA-512.
  3. Wait for the progress bar to finish. Big files can take a few minutes.

Reading the result: Match means your file is identical to the one the publisher released. No match means the file was damaged during download or has been changed. Don't open it; download it again from the official site.

Good to know: The file isn't uploaded anywhere; all the work happens in your browser. Fewer algorithms means faster results.

QR generator

  1. Pick the content type: link, Wi-Fi, contact card, email, location…
  2. Fill in the fields that appear. You can add a logo in the middle and pick an error correction level.
  3. Create the code and download the image.

Good to know: With a logo, pick a high error correction level, because the logo covers part of the code. Test it with a phone before printing.

Subnet & CIDR

  1. Pick what you want to do, for example calculate a block or split one.
  2. Enter the address and prefix length, for example 192.168.1.0/24.
  3. Press the calculate button to see the mask, usable host range and address count.

Good to know: Works with IPv4 and IPv6. Long lists have a button to copy the whole list.

MAC lookup

  1. Enter a MAC address in any format (colons, dashes or none).
  2. Press the lookup button to see the manufacturer and address type.
  3. Need one for testing? Generate a random address.

Good to know: Many phones use a random MAC for each Wi-Fi network, so the manufacturer may not show.

Proxy checker

  1. Paste your proxies, one per line, with or without credentials.
  2. Choose the proxy type, or leave it on Auto if you are unsure: the tool detects the protocol.
  3. Press Run. Results appear line by line; press Stop to end early.

Reading the result: Each line shows whether the proxy is alive, its type, latency, exit address and anonymity level. A transparent proxy reveals your real address. Rows marked Skipped were rejected while reading (bad format, blocked port, private address): the tool never connected to them, so they do not count as dead.

Good to know: Proxy lists and credentials aren't stored. There's a limit per run, and signed-in accounts get a higher one.

SSL/TLS check

  1. Enter a hostname, for example example.com.
  2. Change the port if the service doesn't run on 443.
  3. Press Run to see the certificate, expiry date and supported TLS versions.

Good to know: Renew a certificate with under 30 days left. If the server still accepts TLS 1.0 or 1.1, turn them off.

Reverse IP lookup

  1. Enter an IP address or domain.
  2. Press Run to see other domains hosted on the same server.
  3. If the data source doesn't answer, try again.

Good to know: Results come from collected data and may miss new domains. Servers behind a CDN will show many unrelated domains.

Link preview

  1. Paste the page address.
  2. Press Check to see how the link looks when shared.
  3. Read What to fix to see which tags are missing or wrong.

Good to know: Social apps keep old previews for a while. If you still see the old one after fixing the tags, that's their cache, not your page.

Redirect tracer

  1. Paste the link you want to check, usually a short link or one you're unsure about.
  2. Choose A normal browser. If you suspect the page treats bots and people differently, also try Link preview bot.
  3. Press Trace and read the steps from top to bottom.

Reading the result: Each step has a code: 301 or 308 is a permanent move, 302 or 307 is temporary, 200 means it arrived. The last step is the page people will see after clicking.

Good to know: The tool looks for you and doesn't open the page in your browser. Pages behind an anti-bot wall will block the tool, and the result then says Unknown.

ASN & IP range lookup

  1. Enter an IP address, domain, ASN (for example AS15169) or network name.
  2. Press Look up. If you typed a name, pick the right ASN from the list.
  3. Press Copy all to get every IP range, for example to add to a firewall.

Reading the result: An ASN is the number of a network on the Internet, usually an ISP or a large company. The list of IP ranges shows the address blocks that network is using.

Good to know: Data comes from RIPEstat and is kept for an hour, so very recent changes may not show yet.

Email header analyzer

  1. Open the suspicious email and choose Show original (Gmail) or View source (other apps).
  2. Copy the whole header, paste it into the box and press Analyze.
  3. Read What to fix first, then SPF, DKIM, DMARC and the mail hops.

Reading the result: If SPF, DKIM and DMARC all pass, the email almost certainly came from the domain shown as the sender. A display name that doesn't match the real address, or replies going to an unfamiliar domain, are common signs of phishing.

Good to know: The message body is skipped, never read or stored. The header still contains email and IP addresses, so don't post it publicly.

Unit converter

  1. Pick a unit group, for example length, weight or data size.
  2. Enter a value and choose its unit.
  3. Press the convert button to see the value in every unit of the group.

Good to know: Currencies aren't included because exchange rates change all the time.

Currency converter

  1. Enter the amount. 1,000,000, 1.5 or shorthand like 500k, 5m, 2b all work.
  2. Pick the source and target currencies; the ⇄ button swaps them.
  3. Between VND and a foreign currency, also check the bank block: that is the amount you actually get.

Good to know: The market rate is the mid price and refreshes every minute; bank buy and sell prices differ by a few percent and refresh about every ten minutes.

Number base converter

  1. Pick a task: convert bases, calculate, floating point or Roman numerals.
  2. Enter the value and its base.
  3. Press the convert button to see the result in common bases.

Good to know: Negative numbers depend on the bit width you choose, so set the width first.

Time converter

  1. Pick a task: convert a timestamp, add or subtract time, or measure a gap.
  2. Enter a time or use the current time, then pick a time zone.
  3. Press the convert button to see the result in several formats.

Good to know: Unix timestamps are in seconds. A 13-digit number is usually milliseconds.

Colour converter

  1. Enter a color: hex code, rgb(), hsl() or a color name.
  2. To check readability, add a background color too.
  3. Press the analyze button to see other notations and the contrast level.

Reading the result: Normal text needs a contrast of at least 4.5:1 for level AA. Large text only needs 3:1.

Good to know: Transparent colors are measured on the background you enter.

ID generator

  1. Pick a task: generate new ones, generate from a name, or inspect an existing UUID.
  2. Choose the type and how many you need.
  3. Generate, then click a line to copy it, or copy them all.

Good to know: Name-based UUIDs (v3, v5) always come out the same for the same name and namespace.

Cron reader

  1. Enter a cron expression, or pick a common pattern.
  2. Pick the time zone of the machine that will run the cron job.
  3. Press the read button to see its meaning in words and the next run times.

Good to know: Cron follows the server's clock. A wrong time zone shifts the schedule by exactly the difference.

Keyboard tester

  1. Click the keyboard diagram, then press each key in turn. Working keys turn green; held keys light up in the accent colour.
  2. Leave Layout, Key standard and Operating system on Automatic. The page starts with a laptop diagram and adapts to the keys you press: Home or PgUp switch to a desktop keyboard, a numpad key adds the numpad, 半角/全角, 変換 or ¥ switch to a Japanese keyboard. Pick one by hand to lock it.
  3. Dashed keys are ones many machines lack (Home, End, right Ctrl, Menu…). They do not count until you press them. If a solid key on the diagram does not exist on your keyboard, press Mark missing keys and click it.
  4. Hold many keys at once to measure rollover. To test Tab, Esc and Alt+Tab without leaving the page, use Full screen (Chrome, Edge).
  5. When done, check the Keys not tested yet list, then press Copy report if you need to send it to a repair shop.

Reading the result: Green keys work. Yellow keys chatter: after release they register another press within a few dozen milliseconds, a sign the switch is wearing out. Red keys have been held over 8 seconds while the OS keeps repeating them, so they are really stuck. Keys still listed under Keys not tested yet after several presses are dead.

Good to know: Japanese laptops (Let's note, JIS ThinkPads…): the Fn key sends no signal of its own, so the page tests it indirectly: press Fn + ↑ (PgUp) or Fn + a volume key and the Fn key on the diagram turns green. The first time Home, End, PgUp or PgDn arrives, the page asks whether it was Fn + another key or a separate key. With NumLk on, letter keys such as M, J, K, L send numpad codes. If Windows uses an English layout, the page says so and still draws the printed labels. Turn off Unikey or EVKey while testing so Backspace is not miscounted.

Speaker & headphone test

  1. Turn your system volume down to a moderate level, then press Start auto test.
  2. Answer each question based on what you hear. Press Play again if you missed it, or Skip if a step does not apply (for example the phase step on a single speaker).
  3. To pin down a rattle, run the Frequency sweep on the Bass range and press Mark when you hear something odd.

Reading the result: The final verdict tells you whether channels are swapped or dead, whether a speaker is wired out of phase, whether the bass rattles, and the lowest and highest tones you can hear.

Good to know: To pick another speaker right on the page (Chrome, Edge), press Show speaker names. The page only reads the device list and turns the microphone off at once; nothing is recorded.

Microphone test

  1. Press Turn on microphone and allow the browser to use it. Pick the right mic from the list if you have several.
  2. Press Start auto test: stay quiet for 3 seconds, then read the sentence on screen aloud for 6 seconds.
  3. With several mics, press Test the next microphone; the table below puts each mic's results side by side.

Reading the result: Speech should sit between -40 and -12 dBFS. Clipping above 0.1% means the gain is too high. Speech 30 dB or more above the noise floor is very clear. A range under 4.5 kHz usually means a Bluetooth headset in call mode.

Good to know: Keep the three browser processing options off to measure the raw mic. Audio never leaves your device; the test recording stays in the browser and is gone when you close the page.

API reference

Every tool is reachable over JSON with a personal API key. Full reference → 

curl -s https://authbeta.com/api/v1/totp \
  -H "Authorization: Bearer ab_your_key" \
  -H "Content-Type: application/json" \
  -d '{"secret":"JBSWY3DPEHPK3PXP"}'

Security notes

  • A 2FA secret is as sensitive as a password: anyone holding it can mint valid codes forever.
  • Storing secrets on a server, here or anywhere, trades some of the second-factor idea for convenience. For high-value accounts, keep the secret only on a device you control.
  • Secrets are encrypted with AES-256-GCM using the key in config/config.php. Losing that key makes stored secrets unrecoverable; leaking it exposes them.
  • Always run this site over HTTPS. Codes and secrets travel in request bodies.
  • Turn on two-factor for your own account here as well: it protects the vault.