How Calculations Work

What's actually happening under the hood when a ScriptPulse tool generates, converts, validates, or analyzes your input.

Runs entirely in your browser

This tool executes locally using standard browser APIs (for example window.crypto.getRandomValues or crypto.subtle where applicable). Your input is not transmitted to or stored on a ScriptPulse server. See How Calculations Work.

Browser-Only Execution

ScriptPulse.tools has no backend and no database. Every tool on this site runs its logic in JavaScript inside your browser tab. When a tool needs randomness — a password, a UUID, a symmetric key — it uses the Web Crypto API's crypto.getRandomValues, a cryptographically secure pseudorandom number generator provided by the browser itself, not a developer-supplied Math.random() fallback. Where a tool performs actual encryption, hashing, or key derivation using real cryptographic primitives, it calls crypto.subtle, the same browser-native implementation used by production web applications.

Because nothing is sent to a server, there is nothing for us to log, retain, or accidentally leak from your input. This is also why every tool works over a static, cacheable page with no request round-trip latency for the actual computation.

Deterministic vs. Randomized Calculations

Most tools on this site are deterministic: the same input always produces the same output, because the underlying operation is a pure function of that input. A CIDR subnet split, a Base64 decode, a JSON formatter, a hash digest, and a timestamp conversion all fall into this category — you can independently verify any of them against another correct implementation of the same specification and expect an identical result.

A smaller set of tools are intentionally randomized — password generators, UUID/ULID/NanoID generators, key pair generators, and token generators exist specifically to produce a new, unpredictable value on every run. For these, "correctness" means the output has the right length, format, and entropy characteristics for its type, not that it reproduces a specific value.

The Formulas and Algorithms Behind Common Tool Families

Password & entropy analysis

Password strength indicators are estimated from the size of the character pool actually used and the password's length, following the standard entropy formula log2(pool^length) — the number of bits of entropy a brute-force search would need to cover. This is a composition-based estimate, not a full dictionary/breach-corpus check (see Limitations below).

Subnetting & IP range math

IPv4/IPv6 subnet calculators, CIDR aggregators, and broadcast calculators operate on the address as a fixed-width binary integer and use bitwise AND against the prefix mask to derive the network address, bitwise OR against the inverted mask for the broadcast address, and simple range arithmetic for host counts — the same operations described in the underlying CIDR (RFC 4632) and IPv6 addressing (RFC 4291) specifications, which the Standards & References library links to directly.

Hashing, HMAC, and password hashing

The Hash Generator and HMAC Generator call the browser's native crypto.subtle.digest / crypto.subtle.sign implementations for SHA-family digests and keyed-hash message authentication codes, matching FIPS PUB 180-4 and RFC 2104 respectively. The Bcrypt Hasher runs a JavaScript implementation of the Blowfish cipher-based bcrypt algorithm, applying the configured cost factor as an exponential work-factor parameter, not a linear one — doubling the cost factor roughly doubles computation time. Encryption Studio derives its AES-GCM key via PBKDF2 with a fresh random salt and a fresh random IV generated for every single encryption (not a fixed value reused across operations), and returns them alongside the ciphertext so decryption can recover them.

Encodings (Base64/32/58/85, hex, binary)

Encoding conversions implement the specific alphabet and padding rules of their target encoding (RFC 4648 for Base16/32/64, Base58's Bitcoin-style alphabet, Base85/Ascii85's Adobe/PostScript convention) as direct byte-to-symbol mappings — there is no compression or encryption involved; encoding changes representation, not confidentiality or size in the general case.

Text, JSON, and SQL diffing

JSON Diff Checker and SQL Pretty Diff both compute a real minimal edit script between two inputs using the same Myers-style shortest-edit-distance approach, then render that edit script as the added/removed/changed lines you see highlighted. Text Diff compares inputs line-by-line at matching positions rather than aligning sequences, so a single inserted or deleted line can offset every line after it — see Limitations below.

OpenAPI & JSON Schema validation

OpenAPI Validator and OpenAPI Diff Checker parse your input as real YAML or JSON and check the actual required structure (version field, info block, paths/operations/responses) or the actual added/removed paths and operations between two specs — not a substring match. JSON Schema Validator checks a real, substantial subset of draft-07 (type, required, properties, items, enum, const, numeric/string/array bounds, additionalProperties); any schema keyword outside that set is reported as explicitly unchecked rather than silently passed. None of the three validate deeply-nested component/schema definitions — see Limitations.

Token signing (JWT)

JWT Generator computes a genuine HMAC signature — crypto.subtle.sign over the encoded header and claims, supporting HS256, HS384, and HS512. It does not support asymmetric algorithms (RS256, ES256, etc.), since signing or verifying those requires private-key material this tool doesn't collect.

Limitations

Being transparent about limitations is part of this site's editorial standard, not an afterthought — see our Editorial Policy.

Certificate & PKI Lab tools are a mix of real and simplified implementations, corrected across two remediation passes (2026-07-26 and 2026-07-27): PEM Certificate Decoder and X.509 Certificate Inspector parse the certificate's real ASN.1/DER structure — subject, issuer, serial number, validity dates, algorithm identifiers, and (Inspector only) real X.509v3 extensions (Subject/Authority Key Identifier, Subject Alternative Names, Basic Constraints, Key Usage) are extracted from the actual bytes, not fabricated. CSR Generator generates a real 2048-bit RSA key pair and a genuinely signed PKCS#10 request (RSA/SHA-256 only — it does not offer EC key pairs); CSR Decoder parses a real CSR's actual subject and algorithms. Public Key Extractor extracts a certificate's real public key bytes (private-key input isn't supported yet — that case is disclosed in the tool itself rather than faked). Private Key Inspector reports a real, parsed key format, type, and bit size (or curve) from the key's actual structure, not a hardcoded guess. SSL Certificate Chain Validator checks each certificate's real validity window and whether issuer/subject names chain correctly between the certificates you provide — it does not cryptographically verify that a certificate's signature was actually produced by its issuer's private key, and it has no trusted-root store, so it cannot perform full RFC 5280 §6 path validation. SSH Fingerprint Generator and SSH Public Key Decoder both parse the key's real RFC 4253 §6.6 wire-format bytes — a genuine SHA-256 digest (matching ssh-keygen -lf's default output; MD5 isn't offered, since it isn't available via the browser's Web Crypto API) and a real modulus/curve bit size, respectively, rather than a value guessed from the key-type name. JWK Generator, JWK ↔ PEM Converter, SSH Key Generator, Certificate Transparency Lookup, and SSL Expiration Checker still use a simplified, placeholder decoder or generator rather than real parsing, key generation, or a live query — none of these should be treated as a substitute for a dedicated certificate/key tooling library, a real CT log query service, or your CA's own tools for anything production-security-critical. We list this by tool, rather than as one blanket category note, because the accurate answer is genuinely different from tool to tool.

Password strength estimates are composition-based (character pool and length) and do not check against real-world breach corpora or apply dictionary-attack modeling the way a tool like zxcvbn does — a password can score well on entropy while still being a known-breached or dictionary-adjacent value.

Network lookups (DNS Lookup, ASN Lookup, Reverse DNS Lookup) make real live queries against third-party DNS-over-HTTPS resolvers or public registries reachable from your browser; results reflect what that public resolver returns at query time and are not guaranteed to match authoritative internal DNS views. WHOIS Lookup Parser doesn't perform a network lookup at all — it parses WHOIS text you paste in yourself. Certificate Transparency Lookup is one of the still-simplified tools noted above and does not perform a real CT log query.

Very large inputs are constrained by your browser's available memory and single-tab JavaScript performance, since there is no server-side processing to fall back on.

Current structure: 102 tools · 10 categories · 14 developer hubs · 26 comparisons. Site last built July 26, 2026 (UTC).