Common Security workflows
Decoding, hashing, encrypting and signing are different operations. Decoding a JWT shows its claims but proves nothing; verifying its signature checks one cryptographic relationship; deciding whether to accept it is your application’s job. A hash is one-way, encryption is reversible with a key, and password storage needs a deliberately slow algorithm.
Debug an authentication integration
Calculate an OTP for an exact timestamp or counter, generate a test signing key pair, and inspect the token your application returns.
- TOTP / HOTP Tester — Generate and check time-based or counter-based OTP codes.
- Key Pair Generator — Generate RSA, ECDSA and Ed25519 keys as PEM or JWK.
- JWT Decoder — Decode JWTs, check expiry and verify signatures.
Prepare a sample for sharing
Redact supported patterns and selected JSON fields before sharing a log or API response. Use the HAR-specific redaction flow for browser request archives, and review the output for unsupported identifiers.
- Sensitive Data Redactor — Mask JSON secrets and supported patterns before sharing.
- HAR Analyzer — Inspect request waterfalls, details and redacted HAR exports.
Inspect credentials and cryptographic metadata
Decode a JWT or certificate, then use the tool’s verification controls when applicable. Decoding readable fields is different from verifying a signature, trusting an issuer or validating a complete certificate chain.
- JWT Decoder — Decode JWTs, check expiry and verify signatures.
- SSL Certificate Decoder — Decode X.509 certificates and verify certificate chains.
- CSR Decoder — Check a CSR’s subject, SANs and key before submitting it.
Generate secrets for an application
Create a password or passphrase for a person, a random key for signing tokens, and a bcrypt hash for a test user. Store production secrets in a secret manager, not in source code.
- Password Generator — Strong random passwords and passphrases, with entropy.
- Secret Key Generator — Random keys for JWT secrets, API keys and sessions.
- Bcrypt Generator — Hash passwords with bcrypt and check them against a hash.
Check integrity and encrypt test data
Compute a SHA-256 or HMAC to compare with a published checksum or webhook signature, or encrypt a sample payload with AES-GCM to test your decryption code.
- Hash Generator — MD5, SHA and HMAC hashes of text and files.
- AES Encrypt / Decrypt — AES with a password (OpenSSL compatible) or GCM key.
Verification has a defined scope
A successfully verified JWT signature does not decide whether your application should authorize a request. Check the expected issuer, audience, expiry and algorithm in the application. Similarly, a decoded certificate is not automatically trusted by a browser or operating system.
Use the right algorithm for passwords
Fast hashes such as SHA-256 are designed for integrity checks and are easy to brute-force when used for passwords. Store passwords with bcrypt, scrypt or Argon2 and a per-password salt.
Frequently asked questions
Is it safe to paste a production token here?
Tokens are processed in your browser and not uploaded. Still, treat a live token like a password: prefer a test token, and revoke one you have shared or pasted somewhere untrusted.
Should I hash passwords with SHA-256?
No. Use a slow password hashing algorithm such as bcrypt or Argon2. A general-purpose hash is fine for checksums and HMAC signatures, not for storing passwords.
Tools process your input on this device. Read the privacy policy, or save the tool library for offline use.