Security & Crypto Tools

What it does

Decodes a JSON Web Token (JWT) and displays the header and payload. Also shows token expiration status.

How to use

• Paste a JWT (three base64 parts separated by dots) → click Decode
• The header shows the algorithm, the payload shows the claims

Sample JWT

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.
eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6
IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIy
fQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV
_adQssw5c

Real-World Use Cases

• Debugging OAuth/OIDC authentication flows
• Verifying JWT claims (roles, permissions, expiration)
• Inspecting tokens from Azure AD, Auth0, or Firebase

What it does

Generates RFC 4122 compliant UUID v4 (random) identifiers.

How to use

• Set the count (1–100) → click Generate

Sample Output

f47ac10b-58cc-4372-a567-0e02b2c3d479
6ba7b810-9dad-41d4-80b5-fc0098000000
a1b2c3d4-e5f6-4789-abcd-ef0123456789

Real-World Use Cases

• Generating primary keys for databases (Cosmos DB, DynamoDB)
• Creating correlation IDs for distributed tracing
• Unique identifiers for API resources, sessions, events

What it does

Generates cryptographically strong random passwords using crypto.getRandomValues().

How to use

• Set length, toggle character sets → click Generate
• 5 passwords are generated at once for easy picking

Real-World Use Cases

• Creating strong database passwords
• Generating API keys / access tokens
• Setting up admin accounts for new services

What it does

Computes a Hash-based Message Authentication Code (HMAC) using a secret key. Verifies both data integrity and authenticity.

How to use

• Enter a secret key and message
• Select the algorithm → click Compute HMAC

Real-World Use Cases

• Webhook signature verification (GitHub, Stripe, Twilio)
• API request signing (AWS Signature V4)
• Message authentication in distributed systems

What it does

Generates an RSA public/private key pair in PEM format using the Web Crypto API. Keys are generated entirely in your browser.

How to use

• Select key size (2048 or 4096 bit) → click Generate
• Copy the public and private keys for your use

Real-World Use Cases

• Setting up SSH key authentication
• Creating JWT signing keys (RS256)
• Generating TLS certificate keys for development

What it does

Analyzes password strength by checking length, character diversity, common patterns, and calculates entropy bits. Your password never leaves your browser.

How to use

• Type a password → click Check Strength

Scoring Criteria

• Length (8+ minimum, 16+ ideal)
• Character types (upper, lower, digits, symbols)
• Common patterns (123, qwerty, password)
• Entropy calculation (bits of randomness)

Real-World Use Cases

• Validating password policies before deployment
• Testing if generated passwords meet security requirements
• Educational demonstrations of password security

What it does

Generates a Time-based One-Time Password (TOTP) from a Base32-encoded shared secret — compatible with Google Authenticator, Authy, and Microsoft Authenticator.

How to use

• Paste your Base32 secret (from a 2FA setup page)
• Set time step (usually 30s) and digits (usually 6)
• Click Generate to see the current code and time remaining

Sample Secret

JBSWY3DPEHPK3PXP

Real-World Use Cases

• Testing 2FA setup during app development
• Verifying TOTP implementation against reference
• Emergency code generation when authenticator app unavailable

What it does

Decodes PEM-encoded certificates, public keys, and private keys — shows the type, size, and base64 content structure.

How to use

• Paste a PEM block (including the BEGIN/END markers) → click Decode

Real-World Use Cases

• Inspecting TLS/SSL certificates from servers
• Verifying certificate chains during deployment
• Debugging mutual TLS (mTLS) authentication

What it does

Generates cryptographically secure random bytes using crypto.getRandomValues() in hex, Base64, or decimal format.

How to use

• Set byte count (1–256) and output format → click Generate

Sample Output (32 bytes, hex)

a3f2b1c4d5e6f7890123456789abcdef
fedcba9876543210abcdef1234567890

Real-World Use Cases

• Generating encryption keys / initialization vectors (IVs)
• Creating nonces for cryptographic protocols
• Generating secure session tokens