Security Tools tools

Decode and inspect JWT header, payload and expiry locally. Debug tokens securely in browser.

• Decode JWT header and payload in one click
• Verify signatures when a secret is provided
• Expiry and claim analysis
• +1 more

Create signed JWTs (HS256/RS256) from header+payload locally. Use when creating test tokens; for inspecting existing tokens use jwt-decoder, for Base64 parts use base64. Input: JSON header/payload + secret. Returns JWT string. 100% client-side.

• Build JWTs with custom header and claims
• HS256/384/512 and RS256 signing
• Secret or PEM key input
• +1 more

Generate MD5, SHA-1, SHA-256, SHA-384, and SHA-512 hashes for text. Copy or compare instantly.

• Generate MD5, SHA-1/224/256/384/512, RIPEMD-160, and CRC32 hashes
• HMAC variants with a secret key
• Salt support and bulk per-line mode
• +2 more

Generate time-based OTP codes from authenticator secret. Use for 2FA testing; for random tokens use token-generator. Input: Base32 secret. Returns 6-digit code + QR. 100% client-side.

• Generate TOTP codes compatible with authenticator apps
• Configurable period, digits, and algorithm
• One-click copy of the current code
• +1 more

Decode SSL certificates (subject/expiry/chain). Use for debugging certs. Input: PEM text ≤10MB. Returns parsed fields. 100% client-side.

• Decode X.509 PEM certificates
• Show subject, issuer, and validity dates
• Expiry warnings for expiring certs
• +1 more

Build Content-Security-Policy headers. Use for XSS hardening. Input: directive options. Returns policy string. 100% client-side.

• Visually build Content-Security-Policy headers
• Directive presets and per-source controls
• Live policy preview
• +1 more

Compute MD5/SHA-256/SHA-512 checksums for files to verify integrity. Use for files; for text strings use hash-generator. Input: file ≤10MB. Returns hex digests. 100% client-side, files never uploaded.

• Compute MD5, SHA-1, and SHA-256 checksums
• Drag-and-drop files up to 10 MB
• Compare files against an expected hash
• +1 more

Infer JSON Schema from sample JSON for validation. Use when authoring schemas; for validating instances use json-validator. Input: JSON ≤10MB. Returns JSON Schema draft. 100% client-side.

• Generate JSON Schema drafts from sample data
• Infers types for nested structures
• Copy and download the schema

Hash passwords with bcrypt (cost-configurable) and verify. Use for password storage; for fast checksums use hash-generator, for keyed MACs use hmac-generator. Input: password text. Returns bcrypt hash. 100% client-side.

• Generate bcrypt hashes with configurable rounds
• Verify passwords against a stored hash
• Copy the generated hash
• +1 more

Generate sortable ULIDs (time-ordered IDs). Use when ordering matters; for random UUIDs use uuid-generator, for tokens use token-generator. Input: count option. Returns ULID strings. 100% client-side.

• Generate sortable ULIDs
• Bulk generation with copy support
• Monotonic ordering for time-ordered IDs
• +2 more

Compute HMAC-SHA256/SHA512 for message authentication. Use for webhook signatures; for plain hashes use hash-generator. Input: message + secret key. Returns hex HMAC. 100% client-side.

• Compute HMAC with SHA-256, SHA-512, and more
• Secret key input with live output
• Bulk mode for multiple messages

Generate RSA key pairs locally. Use for SSH/TLS testing. Input: key-size option. Returns PEM public/private keys. 100% client-side.

• Generate RSA key pairs at 1024–4096 bits
• PEM export for public and private keys
• Copy keys to clipboard

Score password entropy, crack time, and improvement tips. Use for auditing; for creating passwords use password-generator. Input: password text (never stored). Returns score + feedback. 100% client-side.

• Score passwords across multiple strength metrics
• Entropy and crack-time estimates
• Concrete improvement suggestions
• +1 more

Generate BIP39 seed phrases for wallets. Use for testing only. Input: word-count option. Returns mnemonic words. 100% client-side.

• Generate 12- or 24-word BIP39 mnemonic phrases
• Validated against the official wordlist
• Copy the full phrase

Look up MAC vendor from OUI prefix. Use for device ID; for new MACs use mac-address-generator. Input: MAC address. Returns vendor. 100% client-side.

• Look up vendor by MAC address prefix
• OUI database with format detection
• Supports common MAC address formats

Generate random MAC addresses. Use for testing; for vendor lookup use mac-address-lookup. Input: count/format options. Returns MACs. 100% client-side.

• Generate random MAC addresses
• Custom OUI prefix support
• Bulk generation with copy

Parse phone numbers to E.164 and region. Use for validation. Input: number + country. Returns formats + validity. 100% client-side.

• Parse international phone numbers
• Country-aware formatting and validation
• Break down country, area, and subscriber parts
• +1 more

Validate IBANs with checksum + country check. Use for bank transfers. Input: IBAN text. Returns valid/invalid + details. 100% client-side.

• Validate IBANs against country-specific rules
• Extract bank and account details
• Format IBANs with proper spacing

Encrypt/decrypt text with AES password. Use for secrets. Input: text + password ≤10MB. Returns ciphertext/plaintext. 100% client-side.

• Encrypt text with AES, TripleDES, Rabbit, and RC4
• Passphrase-based key derivation
• Copy ciphertext or plaintext instantly
• +1 more