About Us

SMT Tooling started as a scratch-pad. I am a backend engineer who spent too many on-call nights recomputing an HMAC by hand, squinting at a SHA-256 to confirm a download, or hunting for a token generator that did not quietly send my secret to a server I had never heard of. The utilities that existed were either heavy desktop apps or web pages that treated a cryptographic secret exactly like a mood-board caption. Neither fit how security-minded developers actually work, so I built the small, honest versions I wanted for myself and put them in one place.

The mission is narrow on purpose. This site is a security and cryptography bench for developers: hash, sign, verify, and generate secrets, fast, with the computation happening in your own browser and nowhere else. We deliberately do not chase every trend or bolt on features that would blur that focus. If a tool here touches a secret, that secret stays on your machine. If a tool makes a claim about how a value was produced, we tell you the algorithm and the source of randomness so you can check our work rather than take it on faith.

Everything is grounded in real incidents. The blog is not filler — it is the collection of mistakes I have watched teams make: the payment webhook that trusted a timing-unsafe comparison, the API keys minted from a predictable random source, the engineer who reached for a cryptographic hash when a CRC32 would have done the job in a fraction of the time. Each tool on the homepage exists because the wrong choice around it once cost someone a bad week.

I test these tools against the standard library outputs I trust and rewrite the guidance whenever a new footgun turns up in the wild. If you find a result that disagrees with your own implementation, or you want a security utility that is missing, I genuinely want to hear about it — that feedback is how the bench grows. Reach me directly at [email protected]. No contact form theater, no ticket queue; just an inbox a developer actually reads.