Tool category

Security & Hashing Tools

Security-related input such as tokens and passwords is exactly the kind of data you should not paste into a site that uploads it. These tools use the browser's Web Crypto API and run locally, so the values you inspect or generate stay on your device.

JWT Decoder

Inspect JWT headers and payloads without sending the token anywhere.

Password Generator

Generate strong random passwords locally with browser cryptography.

Hash Generator

Create SHA-256 hashes with the browser Web Crypto API.

Decoding is not verifying

The JWT Decoder shows a token's header and claims, which is useful for checking expiry or scopes. It does not verify the signature; only the service holding the signing key can confirm a token is genuine.

Hashes and passwords

SHA-256 is suited to checksums and integrity checks. For storing user passwords, use a deliberately slow algorithm such as Argon2 or bcrypt on your server. Generated passwords use cryptographic randomness, not Math.random().