Generate self-signed X.509 certificates for development and testing. Configure validity period, key usage, and SANs.
Fill in the subject name, validity period, key type, key usage, and the hostnames and IP addresses your server answers to, and this tool returns a certificate and its private key, self-signed and generated locally. Nothing is uploaded; the key pair exists only on your machine. The usual surprise is that the certificate is valid and the browser still refuses it: modern browsers match the hostname only against the subjectAltName extension and ignore the common name, so a certificate whose CN is right but whose SAN list omits the hostname always triggers an untrusted warning.
The form fields map directly onto X.509 certificate fields: common name and organization become the subject, the validity period becomes the notBefore and notAfter dates, and the key usage choices become the matching extensions. A key pair is generated at the size you select, and the certificate is signed with its own private key, so issuer and subject are identical.
When a client connects over TLS, it compares the hostname in the URL against the subjectAltName extension in the certificate; modern clients no longer fall back to the common name. DNS names must be listed as DNS entries and IP addresses as IP entries. A certificate that lacks a matching SAN entry is treated as untrusted even though it is cryptographically valid and correctly signed.
That is expected: generating a certificate does not make the browser trust it. Install the certificate into the trust store of the machine running the browser, and confirm that localhost and 127.0.0.1 both appear in the subjectAltName list. The warning persists until both are true.
No. Every visitor's browser would reject it unless you had already installed your certificate on each client machine, which is impractical and provides no real security. For a public site, obtain a certificate from a public CA that browsers trust by default; Let's Encrypt issues these free of charge.
The behavioral notes were checked against the browser implementation. Standards and primary references below define the relevant format, formula, or platform behavior.
Generate strong, random passwords with customizable length, character sets, and complexity requirements.
Analyze password strength with entropy scoring, crack-time estimates, and improvement suggestions.
Create cryptographically random strings for API keys, tokens, salts, and unique identifiers.
Create QR codes for URLs, text, Wi-Fi credentials, vCards, and more with customizable size and colors.
Scan and decode QR codes from uploaded images or your device camera to extract embedded data.
Compute MD5, SHA-1, SHA-256, and SHA-512 checksums to verify file integrity and detect tampering.