Decode JWTs, generate cryptographic hashes and create strong passwords. Everything runs locally, so credentials and secrets never leave your device.
4 tools in this category.
Decode a JSON Web Token into readable header and payload JSON, entirely in your browser.
Break a token down claim by claim, with iat/exp/nbf decoded into real dates and an expiry verdict.
Generate MD5, SHA-1, SHA-256, SHA-384 or SHA-512 digests in hex or Base64, computed locally.
Generate cryptographically secure passwords with guaranteed character variety and a real entropy score.
Four tools that handle material you should be careful where you paste: tokens, secrets and passwords. Everything here runs in your browser and nothing is transmitted, which is not a marketing line but the entire reason this category can exist. Pasting a production JWT into a server-side decoder hands a third party a live credential — one that is often valid for hours and frequently carries the user identity, scopes and tenant of whoever issued it.
The JWT Decoder and JWT Parser both read a token; neither verifies it. That distinction is the single most important thing on this page. Decoding shows you the header and claims, because those are only Base64url-encoded and not secret. Verification means checking the signature against the issuer's key, which proves the token was not forged or altered — and it cannot be done here, because it requires a key you should never paste into a web page. A decoded token tells you what a token claims. Only verification tells you whether to believe it.
The Hash Generator covers MD5, SHA-1, SHA-256 and SHA-512, and the right choice depends entirely on the job. For integrity checks and content addressing, SHA-256 is the default. For passwords, none of these are appropriate: they are built to be fast, which is exactly the property an attacker wants when running billions of guesses. Password storage needs a deliberately slow algorithm such as bcrypt, scrypt or Argon2.