Decode JWT header and payload, inspect claims and check expiration — entirely in your browser.
Security & Token Tools
Working with authentication means constantly reading tokens and checking hashes. The JWT tools decode a token, list its claims and tell you when it expires; the hash tools compute every common digest of a text or file; the HMAC tool produces the signatures that webhooks and API requests are verified with.
Because these tools run entirely in your browser, tokens, secrets and passwords never leave your machine. Key and password generation uses the browser's cryptographically secure random source.
Tools in this category
Create signed JWTs (HS256 / HS384 / HS512) from custom claims for testing.
Analyze JWT claims for missing, risky or non-standard values and get security recommendations.
Check whether a JWT is expired, not yet valid, or how long remains until expiry.
Inspect the JOSE header of a JWT: alg, typ, kid, jku, x5u and potential algorithm-confusion risks.
Decode OAuth 2.0 / OpenID Connect access and ID tokens and understand scopes, audiences and lifetimes.
Generate MD5 hashes of text in your browser (for checksums and legacy comparisons).
Generate SHA-1 hashes of text using the browser WebCrypto API.
Generate SHA-256 hashes of text — the standard for integrity checks and signatures.
Generate SHA-384 hashes of text in your browser.
Generate SHA-512 hashes of text in your browser.
Generate HMAC signatures (SHA-256/384/512/SHA-1) for webhook and API request signing.
Generate cryptographically secure random secrets in hex, Base64 or Base64url.
Generate random API keys with custom prefixes, length and character sets.
Generate RSA key pairs (2048/3072/4096) in PEM format entirely in your browser.
Generate strong random passwords with adjustable length and character classes, plus a strength meter.