Security Tools
Security tooling is the category where it matters most where your data goes. Pasting a production token or secret into a website that uploads it is a real risk, so every tool in this category runs entirely in your browser using the Web Crypto API and never sends your input over the network.
5 free tools
Security Tools
About these security tools
Inspect JWT claims and expiry, sign test tokens for local development, compute SHA hashes for integrity checks, and generate passwords and UUIDs from a cryptographically secure random source. Each tool also explains its limits — for example that decoding a JWT does not verify it.
Why use them
Web Crypto under the hood
Hashing, HMAC signing and random generation use the browser's built-in cryptography rather than custom JavaScript implementations where possible.
Clear limitations
Each tool states what it does not do — decoding is not verification, and MD5 or SHA-1 are not suitable for passwords.
Nothing is stored
Generated passwords, secrets and tokens live only in the page until you leave it.
Frequently asked questions
Is it safe to paste a JWT here?
Decoding happens locally and nothing is transmitted. Even so, treat production tokens as credentials: prefer expired or test tokens, and revoke any token you suspect has been exposed.
How random are the generated passwords and UUIDs?
They use crypto.getRandomValues and crypto.randomUUID, the browser's cryptographically secure random number generator. Password characters are chosen with rejection sampling to avoid modulo bias.