The NexusNimbus Security Toolkit is a collection of more than twenty security and developer tools that run entirely inside your browser. No accounts, no servers, no data ever leaving your machine — every calculation happens locally.
All of them share a single lightweight engine and were built from scratch, including the parts most sites pull from third-party libraries: a from-scratch QR encoder with Reed-Solomon error correction, a CVSS 3.1 calculator that follows the FIRST.org specification exactly, and a browser-fingerprint analyzer. The only network call anywhere is the password checker k-anonymity lookup, which never sends your actual password.
Why build these client-side
Most online security utilities are server-side, which means every hash, token and header you paste is transmitted to somebody else infrastructure and, in many cases, logged. That is an unacceptable default for the exact data these tools handle: production JWTs, email headers containing internal hostnames, credentials being assessed, and vulnerability details before disclosure.
Running the computation in the browser removes the question entirely. There is no server to trust, no retention policy to read, and no breach that could expose what analysts pasted. It also means the tools keep working offline and respond instantly, since nothing waits on a round trip.
What is in the toolkit
- Security analysis: hash identification, password strength and breach checking, phishing URL analysis, email header and authentication tracing, CVSS scoring.
- Encoding and data: Base64, URL percent-encoding, hex, binary and decimal conversion, JSON formatting and validation, JWT inspection.
- Networking and time: CIDR and subnet calculation, Unix timestamp conversion, cron expression explanation.
- Generation: cryptographically random passwords and passphrases, RFC 4122 UUIDs, QR codes.
- Privacy: a browser fingerprint scanner that shows exactly which signals identify you without cookies.
How it is engineered
Every tool registers itself with a shared engine that mounts the correct interface based on the page URL, so the whole suite ships as one minified bundle rather than twenty separate payloads. The logic of each tool is written as pure functions independent of the DOM, which makes them directly testable, and the numerically exacting parts — the CVSS roundup, the Reed-Solomon arithmetic over GF(256), the QR format-information bits — are verified against the published specifications and independent reference implementations rather than assumed correct.
Browse the full collection at the toolkit, or read the accompanying research write-ups that explain the underlying techniques in depth.