mevebu 2.1.0 → 2.3.0

package/README.md

@@ -2,7 +2,7 @@
 
 # mevebu
 
-**205 free browser tools, one page each. No sign up. No uploads. Everything runs in your tab.**
+**215 free browser tools, one page each. No sign up. No uploads. Everything runs in your tab.**
 
 A private toolbox for the small jobs that do not deserve a whole app: format JSON, decode a JWT, make a password, build a cron line, pick a color, scan a QR code, and a lot more.
 
@@ -10,7 +10,7 @@ A private toolbox for the small jobs that do not deserve a whole app: format JSO
 [![npm downloads](https://img.shields.io/npm/dm/mevebu?color=2ea44f)](https://www.npmjs.com/package/mevebu)
 [![License: MIT](https://img.shields.io/github/license/mevebu/mevebu?color=blue)](./LICENSE)
 [![GitHub stars](https://img.shields.io/github/stars/mevebu/mevebu?style=flat&color=yellow)](https://github.com/mevebu/mevebu/stargazers)
-![Tools](https://img.shields.io/badge/tools-205-brightgreen)
+![Tools](https://img.shields.io/badge/tools-215-brightgreen)
 ![Privacy](https://img.shields.io/badge/privacy-100%25%20in--browser-blue)
 
 [Quick start](#quick-start) · [What's inside](#whats-inside) · [Privacy](#privacy-by-design) · [Credit](#credit) · [Development](#development) · [FAQ](#faq)
@@ -23,7 +23,7 @@ A private toolbox for the small jobs that do not deserve a whole app: format JSO
 
 ## What is mevebu?
 
-mevebu is a collection of **205 small online tools** that all run **inside your browser**. Each tool lives on its own page, does one job, and does it fast. Most of them update as you type, so there is no submit button and no waiting.
+mevebu is a collection of **215 small online tools** that all run **inside your browser**. Each tool lives on its own page, does one job, and does it fast. Most of them update as you type, so there is no submit button and no waiting.
 
 Think of it as a clean, private alternative to the usual "free online tools" websites. There are no accounts, no ads in your way, no uploads, and no tracking. Your text, passwords, tokens, and files stay on your device.
 
@@ -64,12 +64,12 @@ mevebu tries port `5555` first, then `5678`, then `5432`, and finally any free p
 
 ## What's inside
 
-mevebu has **205 tools in 20 categories**. Here is the full breakdown:
+mevebu has **215 tools in 20 categories**. Here is the full breakdown:
 
 | Category           | Tools |
 | ------------------ | ----: |
 | Data Generator     |    10 |
-| Passwords and keys |    10 |
+| Passwords and keys |    20 |
 | Developer          |    21 |
 | Convert            |    15 |
 | Text and data      |    14 |
@@ -88,7 +88,7 @@ mevebu has **205 tools in 20 categories**. Here is the full breakdown:
 | GitHub             |     8 |
 | Units              |     8 |
 | QR codes           |     2 |
-| **Total**          | **205** |
+| **Total**          | **215** |
 
 The counts come straight from the tool registry, so this table and the app never drift apart.
 
@@ -176,7 +176,7 @@ That is all. The catalog, search, breadcrumbs, and category pages pick it up aut
 ## FAQ
 
 **What is mevebu?**
-mevebu is a free, open source collection of 205 browser based tools for developers, students, creators, and everyday use. Every tool runs locally in your browser.
+mevebu is a free, open source collection of 215 browser based tools for developers, students, creators, and everyday use. Every tool runs locally in your browser.
 
 **Is mevebu really free?**
 Yes. It is MIT licensed, with no paid tier, no account, and no usage limits.

package/mevebu/app/tailwind.css

@@ -500,6 +500,9 @@
     width: var(--ctl);
     height: var(--ctl);
   }
+  .h-1\.5 {
+    height: calc(var(--spacing) * 1.5);
+  }
   .h-2 {
     height: calc(var(--spacing) * 2);
   }
@@ -566,12 +569,21 @@
   .min-h-8 {
     min-height: calc(var(--spacing) * 8);
   }
+  .min-h-9 {
+    min-height: calc(var(--spacing) * 9);
+  }
   .min-h-11 {
     min-height: calc(var(--spacing) * 11);
   }
   .min-h-24 {
     min-height: calc(var(--spacing) * 24);
   }
+  .min-h-28 {
+    min-height: calc(var(--spacing) * 28);
+  }
+  .min-h-32 {
+    min-height: calc(var(--spacing) * 32);
+  }
   .min-h-40 {
     min-height: calc(var(--spacing) * 40);
   }
@@ -984,9 +996,21 @@
     --tw-border-style: dashed;
     border-style: dashed;
   }
+  .border-current\/15 {
+    border-color: currentcolor;
+    @supports (color: color-mix(in lab, red, red)) {
+      border-color: color-mix(in oklab, currentcolor 15%, transparent);
+    }
+  }
   .border-danger {
     border-color: var(--danger);
   }
+  .border-danger\/40 {
+    border-color: var(--danger);
+    @supports (color: color-mix(in lab, red, red)) {
+      border-color: color-mix(in oklab, var(--danger) 40%, transparent);
+    }
+  }
   .border-jade {
     border-color: var(--jade);
   }
@@ -1017,6 +1041,18 @@
   .bg-danger {
     background-color: var(--danger);
   }
+  .bg-danger\/10 {
+    background-color: var(--danger);
+    @supports (color: color-mix(in lab, red, red)) {
+      background-color: color-mix(in oklab, var(--danger) 10%, transparent);
+    }
+  }
+  .bg-danger\/15 {
+    background-color: var(--danger);
+    @supports (color: color-mix(in lab, red, red)) {
+      background-color: color-mix(in oklab, var(--danger) 15%, transparent);
+    }
+  }
   .bg-deck {
     background-color: var(--deck);
   }
@@ -1367,9 +1403,19 @@
   .text-\[0\.92em\] {
     font-size: 0.92em;
   }
+  .text-\[clamp\(20px\,3\.4vw\,28px\)\] {
+    font-size: clamp(20px, 3.4vw, 28px);
+  }
   .text-\[clamp\(34px\,6vw\,52px\)\] {
     font-size: clamp(34px, 6vw, 52px);
   }
+  .text-\[clamp\(38px\,9vw\,62px\)\] {
+    font-size: clamp(38px, 9vw, 62px);
+  }
+  .leading-\[1\.4\] {
+    --tw-leading: 1.4;
+    line-height: 1.4;
+  }
   .leading-\[1\.5\] {
     --tw-leading: 1.5;
     line-height: 1.5;
@@ -1390,6 +1436,10 @@
     --tw-leading: 1.65;
     line-height: 1.65;
   }
+  .leading-none {
+    --tw-leading: 1;
+    line-height: 1;
+  }
   .leading-normal {
     --tw-leading: var(--leading-normal);
     line-height: var(--leading-normal);
@@ -1426,6 +1476,10 @@
     --tw-tracking: -0.035em;
     letter-spacing: -0.035em;
   }
+  .tracking-\[0\.2em\] {
+    --tw-tracking: 0.2em;
+    letter-spacing: 0.2em;
+  }
   .tracking-\[0\.06em\] {
     --tw-tracking: 0.06em;
     letter-spacing: 0.06em;
@@ -1434,6 +1488,10 @@
     --tw-tracking: 0.08em;
     letter-spacing: 0.08em;
   }
+  .tracking-\[0\.14em\] {
+    --tw-tracking: 0.14em;
+    letter-spacing: 0.14em;
+  }
   .text-balance {
     text-wrap: balance;
   }
@@ -1482,6 +1540,9 @@
   .text-void {
     color: var(--void);
   }
+  .capitalize {
+    text-transform: capitalize;
+  }
   .lowercase {
     text-transform: lowercase;
   }
@@ -1632,10 +1693,18 @@
     --tw-duration: 200ms;
     transition-duration: 200ms;
   }
+  .duration-1000 {
+    --tw-duration: 1000ms;
+    transition-duration: 1000ms;
+  }
   .ease-\[var\(--ease\)\] {
     --tw-ease: var(--ease);
     transition-timing-function: var(--ease);
   }
+  .ease-linear {
+    --tw-ease: linear;
+    transition-timing-function: linear;
+  }
   .outline-none {
     --tw-outline-style: none;
     outline-style: none;

package/mevebu/libs/js/core.js

@@ -750,7 +750,7 @@ export function blank(iconName, text) {
 // ---------- version ----------
 
 // Kept in one place. The CLI reads the same value from package.json.
-export const VERSION = "2.1.0";
+export const VERSION = "2.3.0";
 export const PACKAGE_NAME = "mevebu";
 export const REPO_SLUG = "mevebu/mevebu";
 

package/mevebu/libs/js/registry.js

@@ -391,6 +391,186 @@ export const TOOLS = [
     keywords: "url inspect phishing host homograph link safe",
     load: () => import("./tools/url-inspector.js"),
   },
+  {
+    id: "totp-generator",
+    category: "security",
+    name: "TOTP Generator",
+    icon: "shield-check",
+    note: "Read the code your authenticator would show.",
+    about: "Paste a Base32 secret or an otpauth URI. The code refreshes on its own.",
+    tutorial: {
+      intro: "Get a time based one time password from a secret.",
+      steps: [
+        "Paste a Base32 secret, or a full otpauth:// URI.",
+        "Pick the digits, the period and the hash if they are not the default.",
+        "Copy the code. It changes on its own every period.",
+      ],
+    },
+    keywords: "totp otp 2fa authenticator google authenticator base32 code",
+    load: () => import("./tools/totp-generator.js"),
+  },
+  {
+    id: "totp-verifier",
+    category: "security",
+    name: "TOTP Verifier",
+    icon: "shield-check",
+    note: "Check a code against a secret.",
+    about: "Shows which step matched, so a wrong secret is distinguishable from a wrong clock.",
+    tutorial: {
+      intro: "Debug a two factor integration.",
+      steps: [
+        "Paste the secret and the code.",
+        "Set the drift window, or leave it at one step either side.",
+        "Read the verdict, which names the step that matched.",
+      ],
+    },
+    keywords: "totp verify validate otp 2fa drift clock debug",
+    load: () => import("./tools/totp-verifier.js"),
+  },
+  {
+    id: "passphrase-generator",
+    category: "security",
+    name: "Passphrase Generator",
+    icon: "key-round",
+    note: "Make a passphrase you can type from memory.",
+    about: "Words from a bundled list, with the entropy in bits shown next to it.",
+    tutorial: {
+      intro: "Make a password that is long and memorable.",
+      steps: [
+        "Pick how many words.",
+        "Choose a separator, and whether to add a number or a symbol.",
+        "Press Generate, then copy it.",
+      ],
+    },
+    keywords: "passphrase password memorable words diceware entropy",
+    load: () => import("./tools/passphrase-generator.js"),
+  },
+  {
+    id: "file-hash",
+    category: "security",
+    name: "File Hash Checker",
+    icon: "file-key",
+    note: "Hash a file and compare the checksum.",
+    about: "SHA-1, SHA-256 and SHA-512, read in the tab, with a match or mismatch.",
+    tutorial: {
+      intro: "Verify a download before you open it.",
+      steps: [
+        "Drop the file.",
+        "Paste the checksum you were given.",
+        "Read match or mismatch, and copy any digest you need.",
+      ],
+    },
+    keywords: "file hash checksum sha256 verify download integrity",
+    load: () => import("./tools/file-hash.js"),
+  },
+  {
+    id: "aes-text",
+    category: "security",
+    name: "AES Text Encrypt",
+    icon: "lock",
+    note: "Encrypt a message with a password.",
+    about: "AES-256-GCM with PBKDF2, and one string that carries everything needed to decrypt.",
+    tutorial: {
+      intro: "Send a secret through a channel you do not trust.",
+      steps: [
+        "Write the message and set a password.",
+        "Press Encrypt and copy the string that starts with mv1.",
+        "To read it back, switch to Decrypt, paste the string and the same password.",
+      ],
+    },
+    keywords: "aes encrypt decrypt password gcm pbkdf2 secret message",
+    load: () => import("./tools/aes-text.js"),
+  },
+  {
+    id: "rsa-key-pair",
+    category: "security",
+    name: "RSA Key Pair",
+    icon: "key-round",
+    note: "Make an RSA key pair in PEM form.",
+    about: "Generated in this tab with Web Crypto. Public as SPKI, private as PKCS#8.",
+    tutorial: {
+      intro: "Generate an RSA key pair and copy or download the PEM files.",
+      steps: [
+        "Pick a key size. 2048 is the common floor.",
+        "Press Generate pair and wait a moment for larger keys.",
+        "Copy or download the public and private PEM. Closing the page discards them.",
+      ],
+    },
+    keywords: "rsa key pair pem public private ssh jwt tls generate spki pkcs8",
+    load: () => import("./tools/rsa-key-pair.js"),
+  },
+  {
+    id: "bcrypt-hash",
+    category: "security",
+    name: "Bcrypt Hash",
+    icon: "hash",
+    note: "Hash a password with bcrypt, and check one.",
+    about: "Bcrypt with a cost factor you set, run in this tab with a vendored engine.",
+    tutorial: {
+      intro: "Make a bcrypt hash for a test login, or check a password against one you already have.",
+      steps: [
+        "Type a password and pick a cost factor. 10 is a common default.",
+        "Press Hash password. The timing shows how long this device takes.",
+        "To check, paste a stored hash and the password. The verdict updates as you type.",
+      ],
+    },
+    keywords: "bcrypt hash password login test salt cost compare verify",
+    load: () => import("./tools/bcrypt-hash.js"),
+  },
+  {
+    id: "password-policy",
+    category: "security",
+    name: "Password Policy Builder",
+    icon: "list-checks",
+    note: "Turn a password rule into text, a regex, and a checklist.",
+    about: "The wording, the pattern, and a live check all come from the same settings.",
+    tutorial: {
+      intro: "Write a password policy once, in every form you need.",
+      steps: [
+        "Set the length and the character classes.",
+        "Read the rule in plain words and copy the regex.",
+        "Type a sample password to see which part it fails.",
+      ],
+    },
+    keywords: "password policy regex rule requirements checklist enforce",
+    load: () => import("./tools/password-policy.js"),
+  },
+  {
+    id: "secret-scanner",
+    category: "security",
+    name: "Secret Scanner",
+    icon: "shield-alert",
+    note: "Find API keys and tokens before you paste them.",
+    about: "Known shapes for AWS, GitHub, Slack, Stripe, Google, JWTs and private keys.",
+    tutorial: {
+      intro: "Catch a leaked key before it goes into a chat.",
+      steps: [
+        "Paste the text, or drop a file.",
+        "Read the matches with their line numbers. Values are masked by default.",
+        "Rotate anything listed. A clean result is a hint, not a guarantee.",
+      ],
+    },
+    keywords: "secret scanner leak api key token private key aws github slack stripe jwt detect",
+    load: () => import("./tools/secret-scanner.js"),
+  },
+  {
+    id: "ssh-fingerprint",
+    category: "security",
+    name: "SSH Fingerprint",
+    icon: "fingerprint",
+    note: "Read the fingerprint of an SSH public key.",
+    about: "The SHA-256 form a server prints, plus the older MD5 form for comparison.",
+    tutorial: {
+      intro: "Compare a host fingerprint before you trust it.",
+      steps: [
+        "Paste the public key line, for example ssh-ed25519 AAAAC3...",
+        "Read the fingerprint and compare it with the one the host shows.",
+        "Use the MD5 form only for an old server that still prints that.",
+      ],
+    },
+    keywords: "ssh fingerprint public key sha256 md5 host verify known_hosts",
+    load: () => import("./tools/ssh-fingerprint.js"),
+  },
 
   {
     id: "uuid-generator",

package/mevebu/libs/js/tools/aes-text.js

@@ -0,0 +1,192 @@
+// Encrypt a message with a password. AES-256-GCM with a PBKDF2 key, and the salt
+// and IV packed into the output, so one string is enough to decrypt.
+import {
+  el, icon, toast, bench, stack, panel, textArea, textInput, button, actions,
+  toolcard, notice, copyButton, output, chipRow,
+} from "../core.js";
+
+const ITERATIONS = 310_000;
+const SALT_BYTES = 16;
+const IV_BYTES = 12;
+const VERSION = 1;
+
+function toBase64(bytes) {
+  let binary = "";
+  for (const byte of bytes) binary += String.fromCharCode(byte);
+  return btoa(binary);
+}
+
+function fromBase64(text) {
+  const binary = atob(text.replace(/\s+/g, ""));
+  const out = new Uint8Array(binary.length);
+  for (let i = 0; i < binary.length; i++) out[i] = binary.charCodeAt(i);
+  return out;
+}
+
+async function deriveKey(password, salt) {
+  const base = await crypto.subtle.importKey(
+    "raw",
+    new TextEncoder().encode(password),
+    "PBKDF2",
+    false,
+    ["deriveKey"]
+  );
+  return crypto.subtle.deriveKey(
+    { name: "PBKDF2", salt, iterations: ITERATIONS, hash: "SHA-256" },
+    base,
+    { name: "AES-GCM", length: 256 },
+    false,
+    ["encrypt", "decrypt"]
+  );
+}
+
+export function mount(slot) {
+  let mode = "encrypt";
+
+  const message = textArea({ rows: 6, placeholder: "The message", "aria-label": "Message" });
+  const password = textInput({
+    type: "password",
+    placeholder: "A password you will remember",
+    "aria-label": "Password",
+    autocomplete: "new-password",
+  });
+  const show = el("input", { type: "checkbox", class: "m-0 size-4 accent-[var(--jade)]" });
+  const showLabel = el("label", { class: "inline-flex min-h-9 cursor-pointer items-center gap-2 text-sm text-ink-2" }, show, "Show password");
+
+  const modeRow = chipRow(
+    [
+      { value: "encrypt", label: "Encrypt" },
+      { value: "decrypt", label: "Decrypt" },
+    ],
+    {
+      value: "encrypt",
+      label: "Mode",
+      onChange: (value) => {
+        mode = value;
+        sync();
+      },
+    }
+  );
+
+  const error = notice("warn");
+  const result = output({ rows: 8 });
+  const summary = el("p", { class: "text-sm text-ink-2" });
+
+  function sync() {
+    const decrypting = mode === "decrypt";
+    message.placeholder = decrypting
+      ? "Paste the encrypted text, starting with mv1."
+      : "The message";
+    message.setAttribute("aria-label", decrypting ? "Encrypted text" : "Message");
+    run.textContent = decrypting ? "Decrypt text" : "Encrypt text";
+    result.write("");
+    summary.textContent = "";
+    error.write("");
+  }
+
+  async function act() {
+    error.write("");
+    result.write("");
+    summary.textContent = "";
+    const text = message.value;
+    const pass = password.value;
+    if (!text.trim()) {
+      error.write(mode === "decrypt" ? "Paste the encrypted text first." : "Write the message first.");
+      return;
+    }
+    if (!pass) {
+      error.write("Set a password first.");
+      return;
+    }
+
+    try {
+      if (mode === "encrypt") {
+        const salt = crypto.getRandomValues(new Uint8Array(SALT_BYTES));
+        const iv = crypto.getRandomValues(new Uint8Array(IV_BYTES));
+        const key = await deriveKey(pass, salt);
+        const cipher = new Uint8Array(
+          await crypto.subtle.encrypt({ name: "AES-GCM", iv }, key, new TextEncoder().encode(text))
+        );
+        const packed = new Uint8Array(1 + SALT_BYTES + IV_BYTES + cipher.length);
+        packed[0] = VERSION;
+        packed.set(salt, 1);
+        packed.set(iv, 1 + SALT_BYTES);
+        packed.set(cipher, 1 + SALT_BYTES + IV_BYTES);
+        const encoded = `mv1.${toBase64(packed)}`;
+        result.write(encoded);
+        summary.textContent = `${encoded.length} characters · AES-256-GCM · PBKDF2-SHA-256, ${ITERATIONS.toLocaleString()} rounds`;
+        toast("Encrypted");
+      } else {
+        const clean = text.trim();
+        const body = clean.startsWith("mv1.") ? clean.slice(4) : clean;
+        let packed;
+        try {
+          packed = fromBase64(body);
+        } catch {
+          throw new Error("That is not Base64. Paste the whole string, starting with mv1.");
+        }
+        if (packed.length < 1 + SALT_BYTES + IV_BYTES + 16) throw new Error("That string is too short to be an encrypted message.");
+        if (packed[0] !== VERSION) throw new Error(`This was written by version ${packed[0]}, which this page does not know.`);
+        const salt = packed.slice(1, 1 + SALT_BYTES);
+        const iv = packed.slice(1 + SALT_BYTES, 1 + SALT_BYTES + IV_BYTES);
+        const cipher = packed.slice(1 + SALT_BYTES + IV_BYTES);
+        const key = await deriveKey(pass, salt);
+        let plain;
+        try {
+          plain = await crypto.subtle.decrypt({ name: "AES-GCM", iv }, key, cipher);
+        } catch {
+          throw new Error("Wrong password, or the text was changed after it was encrypted.");
+        }
+        const decoded = new TextDecoder().decode(plain);
+        result.write(decoded);
+        summary.textContent = `${decoded.length} characters`;
+        toast("Decrypted");
+      }
+    } catch (caught) {
+      error.write(caught?.message || "That did not work.");
+    }
+  }
+
+  show.addEventListener("change", () => {
+    password.type = show.checked ? "text" : "password";
+  });
+
+  const run = button("Encrypt text", { icon: "lock", kind: "fill", onclick: act });
+  const copy = copyButton(() => result.textContent, "Copy result");
+  const clear = button("Clear", {
+    icon: "trash",
+    kind: "quiet",
+    onclick: () => {
+      message.value = "";
+      password.value = "";
+      result.write("");
+      summary.textContent = "";
+      error.write("");
+      message.focus();
+    },
+  });
+
+  sync();
+
+  const shell = toolcard({
+    body: bench(
+      stack(
+        el("div", { class: "grid gap-1.5" }, el("span", { class: "text-sm font-semibold text-ink-2" }, "Mode"), modeRow),
+        panel("Message", message),
+        panel("Password", password),
+        showLabel,
+        error
+      ),
+      stack(summary, result,
+        el("p", { class: "m-0 text-2xs leading-[1.6] text-ink-3" },
+          "AES-256-GCM with a key stretched by PBKDF2-SHA-256. The salt and IV are packed into the output, so one string is all you need to decrypt. A lost password cannot be recovered, which is the point."))
+    ),
+    foot: actions(clear, copy, run),
+  });
+
+  slot.append(shell.node);
+
+  return {};
+}
+
+export default { mount };