The premier web-based toolkit built for offensive and defensive security professionals.
Explore the toolkit at toolkit.coffsec.com
COFFSec Toolkit is COFFSec's online collection of practical cybersecurity tools, references, and utilities, built to support security professionals across offensive security, defensive security, and security research workflows.
The project is guided by a single principle:
Make useful security knowledge and tooling accessible, practical, and easy to apply.
Whether you are a penetration tester, red teamer, security engineer, SOC analyst, developer, or researcher, the toolkit is designed to help you move quickly from intent to action.
- Tool Categories
- Use Cases
- Getting Started
- Who It's For
- Design Principles
- Responsible Use
- Contributing
- Contact
The toolkit is organized into categories so that you can locate the right tool quickly.
Tools for key generation, encryption, and cryptographic testing.
| Tool | Description |
|---|---|
| AES | Encrypt and decrypt data using the Advanced Encryption Standard for symmetric cryptography. |
| RSA | Generate RSA key pairs and perform asymmetric encryption and decryption. |
| ECC | Perform Elliptic Curve Cryptography for modern, efficient public key operations. |
| Bcrypt | Generate and verify bcrypt password hashes. |
| XOR | Apply bitwise XOR operations to text or binary data. Intended for analysis and training, not for data protection. |
| Caesar Cipher | Encode and decode text using a classical substitution shift cipher. Intended for education and demonstration. |
| IPv4 Obfuscation | Convert IPv4 addresses to decimal, hexadecimal, or octal representations for testing and payload analysis. |
Screenshots
Generate one-way cryptographic hashes for integrity verification. Algorithm selection should match your security requirements.
| Tool | Description |
|---|---|
| MD5 | Generate 128-bit MD5 digests. Suitable for non-security-critical integrity checks and legacy compatibility. |
| SHA-1 | Generate 160-bit SHA-1 digests. Considered legacy; avoid where collision resistance is required. |
| SHA-256 | Generate 256-bit SHA-256 digests. The standard choice for most modern applications. |
| SHA-384 | Generate 384-bit SHA-384 digests. |
| SHA-512 | Generate 512-bit SHA-512 digests. |
Screenshots
Convert data between common formats and representations.
| Tool | Description |
|---|---|
| Base64 | Encode text or files to Base64 and decode them back to their original form. |
| Hex | Convert text to hexadecimal and vice versa. |
| ASCII | Translate strings into their corresponding ASCII numerical values. |
| URL Encode/Decode | Encode special characters for use in URLs or decode them back to readable text. |
Screenshots
Reformat minified or unstructured code into a readable, consistent layout.
| Tool | Description |
|---|---|
| JSON Beautify | Format, indent, and validate JSON data. |
| JS Beautify | Unminify and format JavaScript source code. |
| SQL Beautify | Reformat SQL queries into a clean, structured layout. |
Screenshots
Utilities for day-to-day development, debugging, and analysis.
| Tool | Description |
|---|---|
| JWT Decoder | Decode, verify, and inspect JSON Web Tokens. |
| Regex Tester | Write, test, and debug regular expressions in real time against sample input. |
| Diff Checker | Compare two blocks of text or code to identify additions, deletions, and modifications. |
| cURL Converter | Convert raw cURL commands into usable code for Python, Node.js, Go, PHP, and other languages. |
| JSON to CSV | Convert JSON arrays and objects into tabular CSV format. |
Screenshots
In-browser authoring and generation tools.
| Tool | Description |
|---|---|
| Password Generator | Generate secure, customizable, and random passwords. |
| QR Code Generator | Generate scannable QR codes from text, links, or contact details. |
| Markdown Editor | Write Markdown with a live rich-text preview. |
| HTML Editor | Write and test HTML, CSS, and JavaScript with instant visual output. |
| SVG Editor | Preview, edit, and refine raw Scalable Vector Graphics code. |
Screenshots
Tools for network calculations, subnetting, and web reconnaissance.
| Tool | Description |
|---|---|
| CIDR Calculator | Calculate network ranges, subnet masks, broadcast addresses, and usable host counts from CIDR notation. |
| Favicon Finder | Discover and extract favicons from target domains for reconnaissance, branding analysis, and asset enumeration. |
Screenshots
The toolkit supports a range of professional security and development workflows, including:
- Offensive security engagements, with practical tooling for penetration testing and adversary simulation.
- Red team operations, with utilities that support authorized security assessments.
- Web and application security, with tools for inspecting and understanding common attack surfaces.
- Detection and response, with resources that build a clearer understanding of attacker behavior.
- Security research, with curated references drawn from COFFSec research and field experience.
- Learning and certification preparation, with material for structured study and hands-on practice.
The toolkit is under continuous development. New tools, references, and categories are added over time.
No installation is required. The toolkit runs entirely in the browser.
- Visit toolkit.coffsec.com.
- Browse the available tools and categories.
- Select the tool relevant to your task.
- Apply it within an authorized and responsible security context.
| Audience | How the Toolkit Helps |
|---|---|
| Penetration Testers | Access practical tooling and references during assessments. |
| Red Teamers | Explore resources for adversary simulation and offensive tradecraft. |
| Security Engineers | Find utilities for hardening, validation, and research. |
| SOC and Detection Teams | Develop a stronger understanding of offensive techniques and attacker behavior. |
| Developers | Understand how security issues surface in real applications and systems. |
| Students and Researchers | Access curated material for structured learning and experimentation. |
- Practical first: prioritize tools and resources that are genuinely useful in security work.
- Accessible: keep the experience simple, fast, and easy to navigate.
- Research-driven: reflect COFFSec's offensive security and research background.
- Community-oriented: share knowledge that helps security professionals improve.
- Responsible use: promote ethical, authorized, and lawful security testing.
The resources in this toolkit are intended for lawful, authorized, and ethical security purposes only.
You are responsible for ensuring that you have explicit permission before testing, scanning, probing, or interacting with any system, application, network, or service that you do not own or are not authorized to assess.
COFFSec does not condone or support unauthorized access, malicious activity, or any use of these resources for illegal purposes.
Contributions, suggestions, and feedback are welcome.
To suggest a tool, resource, category, or improvement:
- Open an issue describing the suggestion.
- Explain how it benefits security professionals.
- Include relevant links, context, and screenshots where useful.
- Submit a pull request if you would like to contribute directly.
Any suggested resource must be lawful to share, responsibly disclosed where applicable, and consistent with ethical security practice.
- Website: coffsec.com
- Toolkit: toolkit.coffsec.com
- Research and Insights: coffsec.medium.com
- LinkedIn: COFFSec
- Email: contact@coffsec.com
Built by COFFSec
Advancing practical cybersecurity through research, tooling, and real-world expertise.
If this toolkit is useful to you, consider starring the repository.