Generators for the files that quietly decide how search engines treat your site, and the small utilities you reach for every week. Everything runs in your browser: no accounts, no uploads, no data leaving your machine.
Static QR codes for links, Wi-Fi, contacts and events. No redirect, no expiry, PNG and SVG out.
Assemble a Content-Security-Policy header and get warned about the parts that undo it.
Build valid JSON-LD for Article, FAQ, Product, LocalBusiness and breadcrumb markup.
Every generator is plain HTML and a few kilobytes of JavaScript. No build step, no sign-up, no rate limit.
Input never leaves the page. There is no API call behind the Generate button, so nothing is logged on our side.
No web fonts, no tracking scripts, no raster images. One small stylesheet and markup that renders on first paint.
A practical, start-to-finish guide to making QR codes that cost nothing and keep working: picking the payload, keeping it short, editable codes without a redirect service, design that still scans, export sizes and the testing routine I run before anything goes to print.
CSRF exploits one browser behavior: cookies are attached automatically, no matter who initiated the request. Tokens work because an attacker can make your browser send a request but cannot read your page to find the token. Here is the whole mechanism, with working PHP.
Hosting & Deployment Web Security
Certificates are free and automated, which is why the remaining failures are so consistent: a missing intermediate that only breaks on some clients, and a renewal cron that fetches a new certificate the server never loads. Here is how to verify both from the command line.