Free online tools that run in your browser
Your files never leave your device · No login required · 100% free
Convert, compress, calculate, generate, edit and check files right in your browser — fast, private and easy to use.
Search results
Popular tools
View all toolsBrowse by category
Popular file conversions
View all convertersProgramming
Learn and practise programming in your browser. Pick a language: write code, run it in a real terminal and follow the lessons step by step.
Why Shiklo Tools?
Simple, private tools that just work — right in your browser.
- Private Everything runs in your browser. Files are never uploaded.
- Secure Encrypted HTTPS connection, and nothing you open is stored on our servers.
- No login required No account, no sign-up, no email. Just open a tool and use it.
- Fast No upload or download wait — results appear instantly.
- Free All tools are free to use, with no limits.
- Works everywhere Phone, tablet or computer, in any modern browser.
🆕 New tools
★ Popular tools
Recently used
Frequently asked questions
Are my files or text uploaded anywhere?
No. Every tool runs inside your browser on your own device. Nothing you enter or open is sent to a server.
Do I need to create an account or log in?
No login is required. There are no accounts — open any tool and start using it straight away.
Are the tools really free?
Yes. All tools are free, with no limits or watermarks. The site is supported by ads.
Does it work on my phone?
Yes. The tools work in any modern browser on phones, tablets and computers.
Can I use the tools offline?
Once a tool has loaded it does its work on your device, so it keeps working even if your connection drops.
Which file types are supported?
PDF, Word, Excel, PowerPoint, OpenDocument and RTF documents, JPG, PNG, WebP, HEIC, AVIF, GIF and BMP images, MP4, MOV, WebM and MKV videos, MP3, WAV, M4A, OGG and FLAC audio, ZIP, 7z, RAR, TAR and GZIP archives, CSV, JSON, XML and plain text. Each tool lists exactly what it opens.
All tools with descriptions →
Password Breach Checker
Check if a password has appeared in a data breach — privately: only 5 characters of its hash are sent (k-anonymity), never the password.
Find out whether a password has already leaked in a data breach. Type it, press Check password, and the tool tells you how many times that exact password appears in the breach lists collected by Have I Been Pwned, a service run by security researcher Troy Hunt.
The check is private by design. Your browser turns the password into a SHA-1 hash and sends only the first 5 of its 40 characters. The service answers with hundreds of hash endings that share those 5 characters, and your browser looks for yours on your own device. Neither the password nor its full hash ever leaves your computer or phone.
How to use Password Breach Checker
- Type or paste the password you want to check.
- Press Check password.
- Read the result: how many times it appears in known breaches, or that it was not found.
- If it was found, change it everywhere you use it and turn on two-factor authentication.
Features
- Checks against the Pwned Passwords list of Have I Been Pwned
- k-anonymity: only 5 characters of the SHA-1 hash are sent, never the password
- Padded answers, so the response size reveals nothing about your password
- Shows exactly what was sent, so you can verify it
- Nothing stored, nothing in the page address, no account or sign-up
- Works on phones, tablets and computers
How the private check works
Sending a password to a website to check it would defeat the purpose, so this tool never does. Instead it uses a technique called k-anonymity. First, your browser computes the SHA-1 hash of the password, a 40-character fingerprint. It keeps 35 characters to itself and sends only the first 5 to the Pwned Passwords service.
Many different passwords share the same first 5 hash characters, so the service cannot tell which one you typed. It replies with the endings of every leaked password that starts with those 5 characters, together with how often each one was seen. Your browser compares its 35 private characters with that list. The answer is also padded with fake entries, so even the size of the reply gives nothing away.
| Step | Where it happens | What is shared |
|---|---|---|
| Hash the password with SHA-1 | Your browser | Nothing |
| Send the first 5 hash characters | Your browser to haveibeenpwned.com | 5 of 40 hash characters |
| Return matching hash endings | Have I Been Pwned | Hundreds of endings plus padding |
| Look for your ending | Your browser | Nothing |
What to do if your password was found
A password found in a breach list is no longer safe, however strong it looks. Attackers load these lists into automated tools and try them against email, banking, shopping and social media logins, an attack known as credential stuffing.
Change the password on every account where you use it, starting with your email account, because email is used to reset other passwords. Use a different password for each site; a password manager makes that easy. Turn on two-factor authentication wherever it is offered, so a stolen password alone is not enough to get in.
Not found does not mean strong
If the password is not in the lists, it has not been seen in the breaches Have I Been Pwned knows about. That is good news, but it says nothing about how easy the password is to guess. A short password, a name with a year or a keyboard pattern can still be cracked quickly even if it never leaked.
Use the Password Strength Checker to see how long a password would take to guess, and the Password Generator to create long random passwords or passphrases that are both unique and strong.
About the data
The Pwned Passwords list contains hundreds of millions of real passwords collected from public data breaches. It is published by Have I Been Pwned under the Creative Commons Attribution 4.0 licence and is used by password managers, browsers and large websites to warn people about compromised passwords.
This tool only checks passwords. To find out whether your email address appears in a breach, visit haveibeenpwned.com directly.
Frequently asked questions
Is it safe to type my real password here?
The password never leaves your device: only the first 5 characters of its SHA-1 hash are sent, which many thousands of different passwords share. If you prefer, you can check a password you are about to stop using.
What exactly is sent over the internet?
Only 5 characters, for example 5BAA6. After each check the tool shows the exact characters that were sent, so you can verify it yourself.
Who runs the breach database?
Have I Been Pwned, a free service created by security researcher Troy Hunt. Its Pwned Passwords data is licensed under Creative Commons Attribution 4.0.
My password was found. What now?
Change it on every account that uses it, starting with your email, and turn on two-factor authentication. Use a unique password for each site from now on.
My password was not found. Is it secure?
Not necessarily. It has not appeared in known breaches, but it may still be easy to guess. Check its strength with the Password Strength Checker.
Is the password stored or logged?
No. It is not saved, not added to the page address and not sent anywhere. Closing the page clears it.
Can I check my email address?
No, this tool checks passwords only. Email checks need a paid key from Have I Been Pwned; use haveibeenpwned.com for that.
Related tools
Password Strength CheckerCheck how strong a password really is: common passwords, words, names, keyboard patterns and dates detected, crack-time estimates and tips.
Password GeneratorGenerate strong random passwords and memorable passphrases. Choose length and characters; see entropy and crack time. Never stored or sent.
TOTP Code GeneratorLive 2FA codes (TOTP, RFC 6238) from a Base32 secret or otpauth link, with SHA-1/256/512, 6 or 8 digits and a QR code for testing.
Hash GeneratorGenerate MD5, SHA-1, SHA-256, SHA-512, SHA-3, BLAKE3 and CRC32 hashes of text or files of any size, with HMAC and checksum comparison. Private.
API Key GeneratorGenerate secure random API keys, tokens and secrets of 128–512 bits in Base62, hex, Base64, Base64URL or Base32, with an optional prefix.