Security tools
Security tools
The category where running in your browser stops being a convenience and becomes the requirement. A JWT is a live credential; pasting one into an online decoder posts it to someone else's server. Nothing here transmits what you enter.
Every security tool
JWT Generator
Build and sign JSON Web Tokens with custom headers, payloads and claims.
Open toolJWT Decoder
Inspect header, payload and expiry without sending the token anywhere.
Open toolPassword Generator & Strength Checker
Create strong passwords and measure entropy, crack time and complexity.
Open toolMD5 Generator
Generate and verify MD5 checksums for text or files, entirely in the browser.
Open toolHash Generator
Hash text or files with MD5, SHA-1, SHA-2, SHA-3, BLAKE2 and RIPEMD-160.
Open tool
Working with JSON Web Tokens
The decoder shows header, payload and expiry locally, which answers “is this token expired or is the API wrong?” without leaking the token. The generator builds and signs tokens with custom headers, payloads and claims for testing an auth flow.
Two corrections worth stating: decoding is not verifying, and a JWT payload is Base64, not encryption — anyone holding the token can read it.
Hashes and checksums
The hash generator covers MD5, SHA-1, the SHA-2 family, the SHA-3 family, BLAKE2b, BLAKE2s and RIPEMD-160 over text or files. The MD5 tool generates and verifies that digest specifically, which is what published download checksums still use.
The limit, stated plainly: MD5 and SHA-1 are broken for collision resistance and belong to accidental-corruption checks, not signatures. And no general-purpose hash belongs in password storage, where a deliberately slow key derivation function is the answer.
Passwords, and how strong they actually are
The generator reports entropy in bits alongside a crack-time estimate. The entropy is the number worth reading: crack times are model-based estimates against assumed attack rates, not guarantees.