Security & Tokens Tools

Security work in a developer day usually means three things: inspecting tokens, generating hashes and keys, and choosing the right primitive. This category covers JWT decoding and validation, hash generation, HMAC, UUIDs and random strings, and it is built around one distinction that causes most of the confusion: encoding, hashing and encryption are three different operations.

JWT tools. A JWT is a signed, structured token, and decoding it is trivial - the payload is Base64url-encoded JSON. The tools here decode the three segments so you can read header, payload and signature, and they validate the claims that matter: whether the token is still within its expiry window, whether the issuer and audience match, and whether the signature actually verifies against the key. Decoding does not verify; the validator is the tool that checks.

Hash tools. A hash is a one-way fingerprint: MD5, SHA-1, SHA-256 and the rest map any input to a fixed-length digest, and you cannot go back. Hashes are used to verify integrity and to store password digests, never as encryption. The generator produces the digest for any input in a choice of algorithms, and the HMAC tool adds a secret key to the mix so only someone who knows the key can reproduce the result.

Key and value generators. UUIDs are the standard 128-bit identifiers for database rows and event IDs; the generator produces v4 random UUIDs. Random strings cover API keys, salts and temporary codes. The difference between them matters: a UUID has a specific shape, a random string can be any length and alphabet you configure, and neither should be used where a hash is required.

Choosing the right primitive is the actual security decision. Use a hash to verify that data has not changed. Use HMAC when two parties share a secret. Use an encryption algorithm when data must be reversible - this category does not ship an encrypter, deliberately, because reversible crypto deserves a dedicated library review rather than a web tool. Use UUIDs and random strings for identity and credentials.

Every operation runs locally in the browser. Token contents, secrets and generated keys never leave the machine. That matters more here than in any other category: the thing you paste into a JWT decoder is often a real production token.