Security and Identifier Tools

Hashing, signing, decoding and generating the strings that security depends on. Compute a checksum, sign a payload with a shared secret, hash a password the way a login system does, read what is inside a JWT, and generate passwords and UUIDs from a proper random source — all without the input leaving your machine.

Every Security & Identifiers tool

Bcrypt Generator

Generate and verify bcrypt password hashes.

CORS Tester

Test a URL for CORS headers or analyse pasted ones.

CSP Builder

Build a Content-Security-Policy header from per-directive source lists.

CSP Tester

Explain a CSP, flag weaknesses, and test whether a URL would load.

HMAC-SHA256 Generator

Sign a message with HMAC-SHA256 and verify signatures.

HTTP Header Inspector

Parse pasted HTTP headers, explain each one and audit security.

Hash Generator

Generate MD5, SHA-1, SHA-256 and SHA-512 digests from text.

JWT Decoder

Decode a JWT and read its claims and expiry.

Memorable Password Generator

Random words, a symbol and digits — strong, and you can remember it.

Passphrase Generator

Diceware passphrases from the EFF wordlist, generated locally.

Password Generator

Strong random passwords generated in your own browser.

Random PIN Generator

Random 4, 6 or 8 digit PINs, avoiding 1234 and 0000.

Random String Generator

Cryptographically random strings in any length and character set.

SSL Certificate Inspector

Decode a PEM certificate and check its dates, names and fingerprints.

UUID Generator

Random v4 or time-ordered v7 UUIDs, generated in your browser.

UUID Validator

Check a list of UUIDs and decode their version, variant and timestamp.

WiFi Password Generator

WPA2/WPA3 keys with no look-alike characters, easy to read aloud.

Hashes

The hash tool computes MD5, SHA-1, SHA-256 and SHA-512 for text or a dropped file, with hex and Base64 output. Use it to verify a download against a published checksum, to produce a cache key, or to check what a system stored. The page is honest about which algorithms are still fit for which purposes — MD5 and SHA-1 for checksums, not for anything an attacker might target.

Signatures and password hashing

HMAC combines a hash with a secret key so the result proves both integrity and possession of the key; the tool produces HMAC-SHA256 and siblings for testing webhook signatures and API authentication. Bcrypt is what login systems should use for passwords: slow by design, salted, with an adjustable cost factor. The bcrypt tool hashes a password at the cost you choose and verifies a password against an existing hash, which is exactly what you need when debugging an authentication flow.

Tokens

The JWT decoder splits a token into header, payload and signature and shows the claims with expiry and issued-at times rendered as dates, so you can see why a token was rejected. It decodes; it does not verify unless you supply the secret, and it says so clearly, because a decoded token is not a trusted token.

Generating identifiers

The password generator draws from the browser's cryptographic random source with control over length, character classes and excluded look-alikes, and shows an entropy estimate. The UUID generator produces v4 random UUIDs, and v7 time-ordered ones where you want sortable keys, singly or in bulk. The UUID validator checks a string's format and reports its version and variant.

The important part

Everything runs in your browser via the Web Crypto API. Secrets, tokens and passwords you paste here are not transmitted, logged or stored anywhere, and nothing persists after the tab closes.