Validation
Validate United States driver's license numbers based on state-specific format rules (CA, NY, TX, FL, etc.)
us-drivers-license-validatorValidation
Validate United States Employer Identification Number (EIN) format used for business tax identification
us-ein-validatorValidation
Validate United States Social Security Number (SSN) format with area number verification
us-ssn-validatorValidation
Validate United States ZIP codes including standard 5-digit and ZIP+4 formats
us-zip-code-validatorSecurity
Generate RFC 6238 TOTP (time-based, 6/8 digits, 30/60s step) and RFC 4226 HOTP (counter-based) one-time passwords from a base32 shared secret, fully offline with HMAC-SHA1/256/512, plus an otpauth:// URI for importing into Google Authenticator / Authy
totp-hotp-offline-generatorValidation
Identify and validate tracking numbers from FedEx, UPS, DHL, USPS, SF Express (顺丰) and other major carriers
tracking-number-validatorSecurity
Scan one or more regex patterns for catastrophic backtracking risk, simulate evil inputs, and suggest safer rewrites
redos-regex-scannerSecurity
Generate, validate and verify OAuth2 / OIDC PKCE (RFC 7636) code_verifier and S256 code_challenge pairs. Three modes: (1) generate a fresh verifier + challenge from cryptographically secure random bytes at 256/384/512/768-bit entropy, (2) audit a verifier you already have against the RFC — length (43–128), charset [A-Za-z0-9-._~] and ≥256-bit entropy, and (3) verify a verifier/challenge pair by recomputing BASE64URL(SHA256(verifier)). Optionally build the full authorization-request URL and token-exchange body. Complements the generic nonce-generator (which only emits a verifier+challenge pair) with RFC-compliance auditing and pair verification.
pkce-code-verifier-generatorValidation
Validate and format phone numbers internationally
phone-validatorSecurity
Generate cryptographically secure one-time numeric codes (SMS / email verification, raffle codes, event pins) with configurable length (3-10 digits), bulk output, optional ambiguous-digit exclusion, and an optional expiry countdown. Uses crypto.randomInt, not Math.random.
otp-generatorSecurity
Estimate real password strength with Shannon entropy, zxcvbn pattern matching (l33t, dictionary, sequences, repeats) and brute-force crack-time across attack scenarios (offline fast/slow hash, online). The password is evaluated locally and never sent anywhere.
password-strength-meterValidation
Validate OpenAPI 3.0/3.1 and Swagger 2.0 documents structurally: required fields, path/operation completeness, response codes, $ref resolution, operationId uniqueness, and component integrity
openapi-validator