Skip to content

THE COLLECTION / 10 FREE TOOLS

Security tools

Decode JWTs and TLS certificates, create hashes and HMAC signatures, and verify file checksums. Every tool runs locally in your browser, so nothing you add is uploaded.

Tokens

Decode JSON Web Tokens, check when they expire, and verify their signatures.

JWT Decoder

Decodes a JSON Web Token to show its header and claims, explains each claim, and tells you if it has expired.

JWT Verifier

Checks a JSON Web Token’s signature against a shared secret or a public key, JWK or JWKS, to prove who issued it and that it has not been changed.

Frontend API Key Safety

Classify an API key, token or environment variable and learn whether it belongs in frontend code or on your backend.

Certificates & keys

Read what is inside a TLS certificate or a signing request, and check that a private key belongs with them.

Certificate Decoder

Decodes an SSL/TLS certificate to show the names it covers, when it expires, who issued it, and every extension inside it.

Key Inspector

Identifies PEM, DER and SSH keys, and checks whether a private key, a certificate and a CSR belong to the same key pair.

CSR Decoder

Decodes a certificate signing request to show the names and details it asks for, and checks that its signature matches the key inside it.

Hashes & signatures

Hash text, and create and check HMAC signatures.

Hash Generator

Calculates SHA-256, SHA-512, SHA-384, SHA-1 and MD5 hashes of any text at once.

HMAC Generator

Creates HMAC-SHA256 (and SHA-512, SHA-384, SHA-1) signatures, and checks webhook signatures.

Check files

Verify a download against its checksum, and find out what a file really is, whatever its name says.

File Type Checker

Finds out what a file really is from its contents rather than its name, and warns when a program is disguised as a document or photo.

File Checksum

Calculates the SHA-256, SHA-512, SHA-384 and SHA-1 checksum of any file and checks it against the one you expect.

About Security tools

Tools for checking and signing data: read what is inside a login token or a TLS certificate, calculate SHA-256, SHA-512 and MD5 hashes of text, create and verify HMAC signatures for webhooks, and check that a downloaded file matches the checksum its publisher lists.

Tokens, keys and files are handled with your browser’s built-in cryptography and never leave your device, which matters most for exactly this kind of sensitive data.

Frequently asked questions

Is it safe to paste real tokens and secret keys?

They are processed only in your browser and never sent anywhere. Still, treat live tokens like passwords and prefer test keys where you can.

Can I use SHA-256 or MD5 to store passwords?

No. They are far too fast, which makes stolen hashes easy to crack. Use a password hashing function such as Argon2id or bcrypt instead.