Security & crypto tools
Debugging tokens, deriving keys, and checking password entropy often involves sensitive material. These tools use Web Crypto and run entirely in your tab so secrets are not uploaded for processing. They are for development and education — not a substitute for a hardened production HSM or secrets manager.
Guides
- Reading a JWT without trusting the serverHow JWT structure, Base64URL encoding, and signatures work — and why decoding locally beats pasting tokens into random websites.
- Generating test JWT tokens locallyHow to create HMAC-signed JWTs for API mocks with iat and exp claims — and why signing should stay in your browser or CI, not a random website.
- Password strength beyond “8 characters”Entropy, dictionary attacks, and zxcvbn-style scoring — why length and uniqueness beat complex rules on a sticky note.
- Generating passwords and tokens in the browserHow to create strong random passwords and API tokens with Web Crypto, character classes, ambiguous-character exclusion, and local-only tools—without Math.random or a server.
- Why “local only” matters for developer toolsWhat browser-local processing means for privacy, compliance, and trust — and when you should still avoid pasting secrets into any website.
Tools in this collection
- JWT DebuggerDecode and inspect JWT payloads in your browser — no upload. Sign test tokens with HMAC; secrets stay on your device.
- JWT test token generatorGenerate signed HS256/384/512 test JWTs with auto iat and exp claims in your browser. Secrets stay local — for API debugging only.
- TOTP ToolGenerate a TOTP secret, show an otpauth QR for authenticator apps, display the live code, and verify codes with Web Crypto — all locally.
- AES-GCM encrypt / decryptEncrypt or decrypt text and files with AES-128/192/256-GCM in your browser: paste hex key and IV, optional AAD, Web Crypto only.
- RSA key generatorGenerate RSA public/private key pairs in your browser with Web Crypto; export PKCS#8 private and SPKI public PEM.
- PEM decoderSplit PEM text into labeled Base64 payloads and DER byte lengths in your browser — pairs with PKI and RSA tools.
- HKDF & PBKDF2 playgroundDerive keys from a passphrase or IKM with visible salt, info, iterations, and hash — Web Crypto in your browser.
- Password Strength & EntropyMeasure entropy, zxcvbn strength, and estimated crack times across hardware tiers — 100% offline in your browser.
- Secret ShareSeal text with AES-GCM and a master password. Share a single link where ciphertext and IV live in the URL hash — nothing is stored on a server.
- HMAC & Webhook VerifierGenerate and verify HMAC signatures (SHA-256, SHA-512, SHA-1, MD5) for webhook bodies — hex or Base64, entirely in your browser.
- PKI & Certificate StudioGenerate RSA and ECC keys, build CSRs and self-signed certificates, and inspect PEM chains — all locally in your browser.
- Multi-Hash & Base64 FactoryEncode text to Base64, hex, URL, and HTML entities; compute SHA-256, SHA-512, SHA-1, and MD5 — all live in your browser. Drop a file for a local SHA-256 checksum.