Security tools

Decode JWTs, create hashes and HMAC signatures, and verify file checksums. Every tool runs in your browser, so nothing you add is uploaded.

Tokens

Decode JSON Web Tokens and check when they expire.

JWT Decoder

Decodes a JSON Web Token to show its header and claims, explains each claim, and tells you if it has expired.

Hashes & signatures

Hash text and files, verify downloads, and create HMAC signatures.

Hash Generator

Calculates SHA-256, SHA-512, SHA-384, SHA-1 and MD5 hashes of any text at once.

File Checksum

Calculates the SHA-256, SHA-512, SHA-384 and SHA-1 checksum of any file and checks it against the one you expect.

HMAC Generator

Creates HMAC-SHA256 (and SHA-512, SHA-384, SHA-1) signatures, and checks webhook signatures.

About Security tools

Tools for checking and signing data: read what is inside a login token, calculate SHA-256, SHA-512 and MD5 hashes of text, create and verify HMAC signatures for webhooks, and check that a downloaded file matches the checksum its publisher lists.

Tokens, keys and files are handled with your browser’s built-in cryptography and never leave your device, which matters most for exactly this kind of sensitive data.

Frequently asked questions

Is it safe to paste real tokens and secret keys?

They are processed only in your browser and never sent anywhere. Still, treat live tokens like passwords and prefer test keys where you can.

Can I use SHA-256 or MD5 to store passwords?

No. They are far too fast, which makes stolen hashes easy to crack. Use a password hashing function such as Argon2id or bcrypt instead.