What these tools are not.

A generated password is only as strong as the way it is stored. 128 bits of entropy written on a sticky note, reused across four sites or pasted into a chat window is not 128 bits of protection, and a weaker password inside a password manager usually is. The generator cannot see where its output ends up, and the entropy figure describes the draw, not the storage.

The entropy figure counts words against a list that is published, so it assumes an attacker who has that list. That is the honest way to count, and it means length is doing the work: each word you add is worth the whole list again. The storage caveat above applies here as well, and it is the part that decides the outcome.

A digest confirms integrity, not authenticity. A file arriving with a matching SHA-256 tells you it was not corrupted in transit. It does not tell you who produced it, because anyone who can change the file can compute the new digest just as easily. Proof of origin needs a signature or a keyed MAC, which is a different tool with a different key. MD5 and SHA-1 are broken for collision resistance and must not be used where an attacker gains by finding a collision: certificates, signatures or any comparison you are leaning on. They are fine for spotting accidental corruption and nothing else.

JPEG is lossy, and repeated conversion compounds the loss. Re-compressing a photograph that is already a JPEG throws away more than it did the first time, and the damage shows up when the image is enlarged or printed. Keep the original and compress once. Converting a PNG that has transparency to JPEG fills those areas with a colour you did not choose. An output can also come out larger than its source when the source was already optimised, so read the byte count rather than assuming it improved.

Browsers cache icons hard and choose the size they want for a tab, a bookmark or a home screen without asking. An icon that refuses to update is almost always the browser's cache rather than a broken file, and a browser is free to ignore any of the sizes in a generated set.

A contrast ratio is a conformance check against a WCAG threshold, such as 4.5:1 for body text under AA. It is not a usability guarantee: it says nothing about colour vision, glare on a phone held in daylight, a typeface too light for the size it is set at, or whether the words are worth reading. Passing is a floor, not a target. A hex value is also not a colour you can guarantee, since the same value renders differently across displays, profiles and wide-gamut screens. Check on the screens that matter, not only the one you are sitting at.

Base64 is an encoding, not encryption. It hides nothing at all, and it decodes with a command that ships with every operating system. Treat the output as the original data in a different coat: a data URI carrying an identity document is that document in a text field, ready to be logged, indexed and backed up.

A spreadsheet is flatter than JSON. The conversion pushes nested objects out into one column per leaf or into a JSON string, and it loses type information on the way: numbers become text, leading zeros disappear, long integers can be read as floating point, and a date means whatever the tool reading it decides. Keep the JSON as the source of truth and treat the CSV as a view of it.

A diff compares text, not meaning. Line endings changing from CRLF to LF, trailing whitespace, or a paragraph rewrapped at a different width all appear as changes when nothing of substance moved. A diff also never tells you which of the two versions is correct, or what a change was for.

Word counts disagree between tools because the word does. Hyphenated compounds, URLs, initialisms and bare numbers are counted differently by each, and scripts that do not put spaces between words are counted differently again. Reading time is an estimate from a fixed words-per-minute figure, not a measurement of your reader.

Bench is not responsible for decisions made from what a tool produces. If a generated password is guessed, if a compressed image turns out to be the only copy left, if a matching digest is treated as proof of who sent a file, that outcome belongs to whoever made the call.

Where a tool shows the settings and the numbers behind an output, read them before you rely on it. That is what they are there for.

The site carries advertising, which is what pays for it. What advertising does not buy is a mention. No article here is sponsored, no link in one is an affiliate link, no vendor has paid to be named, and no tool recommends a product.

Advertising is served by Google and sits apart from the writing. It has no access to anything you put into a tool, and it has no say in what any page says. The terms set out the advertising clause and the privacy policy sets out what it means for your data.