Decode JWT header and payload, inspect claims and check expiration — entirely in your browser.
Security
Security & Token Tools
Working with authentication means constantly reading tokens and checking hashes. The JWT tools decode a token, list its claims and tell you when it expires; the hash tools compute every common digest of a text or file; the HMAC tool produces the signatures that webhooks and API requests are verified with.
Because these tools run entirely in your browser, tokens, secrets and passwords never leave your machine. Key and password generation uses the browser's cryptographically secure random source.
Tools in this category
Create signed JWTs (HS256 / HS384 / HS512) from custom claims for testing.
Security
Analyze JWT claims for missing, risky or non-standard values and get security recommendations.
Security
Check whether a JWT is expired, not yet valid, or how long remains until expiry.
Security
Inspect the JOSE header of a JWT: alg, typ, kid, jku, x5u and potential algorithm-confusion risks.
Security
Decode OAuth 2.0 / OpenID Connect access and ID tokens and understand scopes, audiences and lifetimes.
Security
Generate MD5 hashes of text in your browser (for checksums and legacy comparisons).
Security
Generate SHA-1 hashes of text using the browser WebCrypto API.
Security
Generate SHA-256 hashes of text — the standard for integrity checks and signatures.
Security
Generate SHA-384 hashes of text in your browser.
Security
Generate SHA-512 hashes of text in your browser.
Security
Generate HMAC signatures (SHA-256/384/512/SHA-1) for webhook and API request signing.
Security
Generate cryptographically secure random secrets in hex, Base64 or Base64url.
Security
Generate random API keys with custom prefixes, length and character sets.
Security
Generate RSA key pairs (2048/3072/4096) in PEM format entirely in your browser.
Security
Generate strong random passwords with adjustable length and character classes, plus a strength meter.
Security
Guides
More guides Learn more
Security
What is a JWT? JSON Web Tokens Explained
JWT explained simply: the three parts of a JSON Web Token, claims like exp and sub, how to decode and verify one, why decoding is not verifying, and security.
PerformancePerformance & Security Resilience Testing
How to test a product under load, failure and attack: load, stress and soak tests with real targets, failure injection, the OWASP baseline and what to record.