Security and Data Tools
Security and integrity tools help inspect tokens, calculate digests, and authenticate messages. Each page explains the boundary between encoding, hashing, checksums, and verification.
4 browser-based tools availableSecurity and Data Tools
Hash Generator
Generate SHA hashes with the Web Crypto API.
Security and Data ToolsJWT Decoder
Inspect JWT headers and payloads without verification.
Security and Data ToolsHMAC Generator
Sign a message with HMAC-SHA-256, SHA-384, or SHA-512 using Web Crypto.
Security and Data ToolsChecksum Generator
Calculate SHA-256, SHA-384, or SHA-512 checksums from UTF-8 text.
Security and Data ToolsBenefits
- Use browser-native cryptography for common SHA and HMAC operations
- Inspect JWT structure without silently claiming verification
- Compare integrity values without uploading source data
When to use these tools
- Checking known SHA digest vectors
- Testing webhook HMAC signatures
- Inspecting JWT headers and claims during debugging
Common mistakes
- Treating a decoded JWT as a verified or trusted token
- Confusing an unkeyed checksum with message authentication
- Exposing shared secrets in logs, URLs, or analytics
Popular in this category
Security and Data Tools FAQ
Does JWT Decoder verify signatures?
No. It only displays token sections. Verification requires the correct key, algorithm policy, and application context.
Are HMAC secrets stored?
No. The secret is held only in component memory for the current tab and is excluded from analytics and storage.
Which APIs perform cryptographic operations?
Hashing, checksums, and HMAC use the browser Web Crypto API.
Inspect security data carefully
Choose a tool below and read its limitation notice before using the result in a security decision.