# Keysmith

> Audit certificates, keys, TLS and passwords in one lab; secrets stay on your device. Keysmith is a crypto and secrets lab that turns fourteen usefulweb.site security tools into one workspace. Collect certificates, public keys, TLS configurations, checksums, password policies, KDF settings, decoding recipes, secret-sharing plans and passkey responses in a project, run them all, and get one dashboard of findings with an expiry timeline, calendar reminders, A/B comparisons and a printable report. Hashes, HMACs, PBKDF2, HKDF, file encryption, password generation, Shamir splitting and breach checks run in your browser; anything that needs the server asks first.

Keysmith (Crypto & secrets lab) is a premium app of usefulweb.app (https://usefulweb.app/): a full program that runs in the browser. Its engine is deterministic and the same functions are exposed as tools, so an agent can compute exactly what the app shows.

## Use it
- Landing page: https://keysmith.usefulweb.app/
- Workspace (browser app): https://keysmith.usefulweb.app/app - open a project with https://keysmith.usefulweb.app/app#project=<base64url-encoded project JSON> or a template with https://keysmith.usefulweb.app/app#template=<id>
- Project file format (JSON Schema): https://keysmith.usefulweb.app/project.schema.json
- Tutorials: https://keysmith.usefulweb.app/tutorials
- JSON API: POST https://keysmith.usefulweb.app/api/v1/tools/<toolId>/calculate (catalog: https://keysmith.usefulweb.app/api/v1/tools)
- OpenAPI: https://keysmith.usefulweb.app/openapi.json
- MCP (Streamable HTTP): https://keysmith.usefulweb.app/mcp

## Engine tools
- [X.509 / ASN.1 Certificate Inspector](https://x509certificateinspector.usefulweb.app/): Decode X.509 certificates, chains and CSRs: SANs, usages, CT SCTs, chain order and an ASN.1 tree. API: POST https://keysmith.usefulweb.app/api/v1/tools/x509-certificate-inspector/calculate · MCP tool `x509_certificate_inspector`
- [RSA/ECC Key Inspector](https://rsaecckeyinspector.usefulweb.app/): Inspect PEM, DER, JWK or OpenSSH keys: type, size, curve, fingerprints, thumbprint and weaknesses. API: POST https://keysmith.usefulweb.app/api/v1/tools/rsa-ecc-key-inspector/calculate · MCP tool `rsa_ecc_key_inspector`
- [TLS Cipher-Suite Simulator](https://tlsciphersuitesimulator.usefulweb.app/): See which TLS version, cipher and group browsers, Android, Java and OpenSSL get from your server. API: POST https://keysmith.usefulweb.app/api/v1/tools/tls-cipher-suite-simulator/calculate · MCP tool `tls_cipher_suite_simulator`
- [Hash & HMAC Calculator](https://hashhmaccalculator.usefulweb.app/): MD5, SHA-2, SHA-3, BLAKE2, CRC32 and HMAC of text or files, with checksum compare. API: POST https://keysmith.usefulweb.app/api/v1/tools/hash-hmac-calculator/calculate · MCP tool `hash_hmac_calculator`
- [Password & Passphrase Generator](https://passwordgenerator.usefulweb.app/): Strong random passwords and passphrases, made in your browser, with exact entropy. API: POST https://keysmith.usefulweb.app/api/v1/tools/password-generator/calculate · MCP tool `password_generator`
- [Password Entropy Race](https://passwordentropyrace.usefulweb.app/): Race 2–6 passwords or passphrases: entropy, pattern penalties and crack times. API: POST https://keysmith.usefulweb.app/api/v1/tools/password-entropy-race/calculate · MCP tool `password_entropy_race`
- [Private Breach Checker](https://privatebreachchecker.usefulweb.app/): Check if a password appears in known breaches without revealing it (k-anonymity). API: POST https://keysmith.usefulweb.app/api/v1/tools/private-breach-checker/calculate · MCP tool `private_breach_checker`
- [Key Derivation Lab](https://keyderivationlab.usefulweb.app/): Derive keys with PBKDF2, scrypt, Argon2id and HKDF; compare costs with OWASP advice. API: POST https://keysmith.usefulweb.app/api/v1/tools/key-derivation-lab/calculate · MCP tool `key_derivation_lab`
- [Crypto Kitchen](https://cryptokitchen.usefulweb.app/): CyberChef-style recipes: chain encodings, compression, hashes, AES, JWT and more, step by step. API: POST https://keysmith.usefulweb.app/api/v1/tools/crypto-kitchen/calculate · MCP tool `crypto_kitchen`
- [CyberChef-lite Pipeline](https://cybercheflitepipeline.usefulweb.app/): One-click decoding recipes: JWT, base64 → gunzip → JSON, double URL decode, hex dump. API: POST https://keysmith.usefulweb.app/api/v1/tools/cyberchef-lite-pipeline/calculate · MCP tool `cyberchef_lite_pipeline`
- [Shamir Secret Sharing](https://shamirsecretsharing.usefulweb.app/): Split a secret into n shares so any k recover it, and combine shares, locally. API: POST https://keysmith.usefulweb.app/api/v1/tools/shamir-secret-sharing/calculate · MCP tool `shamir_secret_sharing`
- [Passkey & WebAuthn Tester](https://passkeywebauthntester.usefulweb.app/): Test passkeys in your browser and decode WebAuthn responses: flags, AAGUID, signatures. API: POST https://keysmith.usefulweb.app/api/v1/tools/passkey-webauthn-tester/calculate · MCP tool `passkey_webauthn_tester`
- [Local File Encryption Studio](https://fileencryptionstudio.usefulweb.app/): Encrypt and decrypt files with AES-256-GCM and a password, locally in your browser. API: POST https://keysmith.usefulweb.app/api/v1/tools/file-encryption-studio/calculate · MCP tool `file_encryption_studio`
- [Emoji Cipher Playground](https://emojicipherplayground.usefulweb.app/): Turn secret notes into emoji and back: substitution, Caesar shift and base-emoji. API: POST https://keysmith.usefulweb.app/api/v1/tools/emoji-cipher-playground/calculate · MCP tool `emoji_cipher_playground`

## Formats
- Import: Keysmith project (.keysmith.json), PEM certificates, chains and public keys, JWK and OpenSSH public keys, sha256sum / shasum manifests, Any file to hash or encrypt (stays local), UWFE encrypted files (.uwenc), Project link (#project=…)
- Export: Keysmith project (.keysmith.json), Findings CSV, Inventory CSV, Batch results CSV, Reminders calendar (.ics), Timeline and severity charts (SVG, PNG), Printable report (PDF via print), Findings JSON, Encrypted files (.uwenc), Share cards (print)

## Limits
- Keysmith does not scan live servers or fetch certificates from hosts; you paste certificates and choose TLS profiles.
- The TLS simulator uses recorded client handshake profiles and grades on its own scale; it is not a replacement for a live scan.
- MD5, SHA-3, BLAKE2, CRC32, scrypt, Argon2id and passphrases need the server tool; Keysmith asks before sending secret inputs.
- Batch runs go through the tool API rate limits (heavier tools allow about six calls per minute); long batches wait and resume.
- Files for hashing and encryption are kept in memory only; reopen them after a reload. Encrypted output is a download, not stored.
- Breach checks rely on the Have I Been Pwned range API being reachable through usefulweb.site.
- On phones the workspace is a single column; long PEMs and tables are easier on a larger screen.