Free online tools that run in your browser
Your files never leave your device · No login required · 100% free
Convert, compress, calculate, generate, edit and check files right in your browser — fast, private and easy to use.
Search results
Popular tools
View all toolsBrowse by category
Popular file conversions
View all convertersProgramming
Learn and practise programming in your browser. Pick a language: write code, run it in a real terminal and follow the lessons step by step.
Why Shiklo Tools?
Simple, private tools that just work — right in your browser.
- Private Everything runs in your browser. Files are never uploaded.
- Secure Encrypted HTTPS connection, and nothing you open is stored on our servers.
- No login required No account, no sign-up, no email. Just open a tool and use it.
- Fast No upload or download wait — results appear instantly.
- Free All tools are free to use, with no limits.
- Works everywhere Phone, tablet or computer, in any modern browser.
🆕 New tools
★ Popular tools
Recently used
Frequently asked questions
Are my files or text uploaded anywhere?
No. Every tool runs inside your browser on your own device. Nothing you enter or open is sent to a server.
Do I need to create an account or log in?
No login is required. There are no accounts — open any tool and start using it straight away.
Are the tools really free?
Yes. All tools are free, with no limits or watermarks. The site is supported by ads.
Does it work on my phone?
Yes. The tools work in any modern browser on phones, tablets and computers.
Can I use the tools offline?
Once a tool has loaded it does its work on your device, so it keeps working even if your connection drops.
Which file types are supported?
PDF, Word, Excel, PowerPoint, OpenDocument and RTF documents, JPG, PNG, WebP, HEIC, AVIF, GIF and BMP images, MP4, MOV, WebM and MKV videos, MP3, WAV, M4A, OGG and FLAC audio, ZIP, 7z, RAR, TAR and GZIP archives, CSV, JSON, XML and plain text. Each tool lists exactly what it opens.
All tools with descriptions →
security.txt Generator
Create a valid security.txt file (RFC 9116) so researchers know how to report vulnerabilities — with checks for every field.
When a security researcher finds a vulnerability in your website, they need to know whom to tell. Without clear contact details, reports end up in a general inbox, on social media, or not at all. security.txt is the standard answer: a small text file at /.well-known/security.txt that lists your security contact and policy, defined in RFC 9116 and used by governments, banks, technology companies and open-source projects.
This generator builds the file for you. Enter at least one contact — an email address, a phone number or a reporting page — and an expiry date, then optionally add a link to your PGP key, an acknowledgments page, preferred languages, your disclosure policy, the file's canonical address and a security jobs page. Every field is checked against the RFC as you type, and the finished file is ready to copy or download. Nothing is sent anywhere.
How to use security.txt Generator
- Enter your security contact (email, phone or reporting page).
- Choose an expiry date within the next year.
- Add any optional fields you want.
- Download security.txt and publish it at /.well-known/security.txt.
Features
- All RFC 9116 fields: Contact, Expires, Encryption, Acknowledgments, Preferred-Languages, Canonical, Policy, Hiring.
- Email addresses turned into mailto: links automatically.
- Checks for missing, invalid or out-of-date values.
- Expiry kept within a year, as the RFC recommends.
- Copy or download the finished file.
- Runs in your browser; nothing is sent.
The fields
Only Contact and Expires are required. The others make reporting easier and help researchers trust the file.
| Field | Required | Example |
|---|---|---|
| Contact | Yes (one or more) | mailto:security@example.com |
| Expires | Yes | 2027-10-01T23:59:59Z |
| Encryption | No | Link to your PGP public key |
| Acknowledgments | No | Hall-of-fame page for reporters |
| Preferred-Languages | No | en, de |
| Canonical | No | https://example.com/.well-known/security.txt |
| Policy | No | Your vulnerability disclosure policy |
| Hiring | No | Security job openings |
Where to publish it
Save the file as security.txt and serve it at https://your-domain/.well-known/security.txt, with the content type text/plain and over HTTPS. You can also place a copy at /security.txt for older tools. If you have several domains, publish a file on each, or use the Canonical field to point to the official one. Static hosts usually serve a .well-known folder as-is; on some platforms you add a route or upload the file through the dashboard.
Keeping it current
The Expires field stops stale contact details from living forever: after that date, researchers should treat the file as outdated. The RFC recommends an expiry less than a year ahead, so the generator flags anything later. Put a reminder in your calendar to review the contacts and renew the date before it passes. Using a shared mailbox or reporting form rather than a personal address keeps the file valid when people change roles.
Signing the file
RFC 9116 allows the file to be signed with OpenPGP as a cleartext signature, so readers can check it wasn't altered. Generate a key with the PGP Key Generator, publish the public key and link it in the Encryption field, then sign the file with GnuPG (gpg --clearsign security.txt) before uploading. Signing is optional but adds trust for high-profile sites.
Related tools
Strengthen the rest of your site's security configuration with the CSP Generator, the Permissions-Policy Generator and the Security Headers Checker. To tell search engines how to crawl your site, use the Robots.txt Generator.
Frequently asked questions
Do I need a bug bounty to publish security.txt?
No. It only says how to contact you; a Policy link can explain whether rewards are offered.
Can the contact be a web form?
Yes. Contact can be an https:// page as well as an email address or phone number.
What happens after the Expires date?
Researchers should treat the file as outdated, so renew it before then.
What is security.txt?
A standard text file (RFC 9116) at /.well-known/security.txt that tells researchers how to report security problems.
Which fields are required?
Contact and Expires.
Where do I put the file?
At /.well-known/security.txt on your domain, served as text/plain over HTTPS.
How far ahead can Expires be?
The RFC recommends less than a year.
Can I list more than one contact?
Yes; contacts are listed in order of preference.
Should I sign the file?
It is optional; signing with OpenPGP lets readers verify it.
Is my information sent anywhere?
No. The file is built in your browser.
Related tools
PGP Key GeneratorCreate an OpenPGP key pair (ECC Curve25519 or RSA 4096) with a passphrase, expiry and revocation certificate — for email and file encryption.
CSP GeneratorBuild a Content-Security-Policy header or meta tag from a strict starting point, and check any policy for common weaknesses.
Security Headers CheckerCheck a website's HTTP security headers — HSTS, CSP, X-Frame-Options, Referrer-Policy and more — get a grade and how to fix each gap.
Permissions-Policy GeneratorBuild the Permissions-Policy header that turns off the camera, microphone, location and other browser features your site doesn't use.
Robots.txt Generator & TesterCreate a robots.txt with rules per crawler, AI crawler blocking and sitemap lines, then test any URL against any robots.txt file.
XML Sitemap GeneratorCreate a valid XML sitemap from a list of URLs or a CSV: duplicates removed, dates checked, split into files of 50,000 URLs with an index.