API & Security
Inspect tokens, build requests and generate identifiers.
- UUID GeneratorGenerate random v4 or time-ordered v7 UUIDs in bulk, and decode any UUID’s version and timestamp. Generated locally from a secure random source.Open tool
- JWT DecoderDecode a JWT header and payload, see exactly when it expires, and get warned about alg none and millisecond timestamps. Runs in your browser.Open tool
- Hash GeneratorGenerate MD5, SHA-1, SHA-256, SHA-384 and SHA-512 hashes of any text at once, bit-exact against the published specification vectors, in your browser.Open tool
- Password GeneratorGenerate strong random passwords in your browser using the cryptographic random source, with the real entropy in bits shown for each one.Open tool
- Certificate DecoderDecode a PEM certificate in your browser. Subject, issuer, SANs, validity, key size and SHA-256 fingerprint, with expiry and weak-algorithm warnings.Open tool
- ASN.1 / DER InspectorWalk any ASN.1 DER structure as a tree. Tags, lengths, offsets and decoded values, from PEM, base64 or hex, entirely in your browser.Open tool
- CSP AnalyzerPaste a Content-Security-Policy header to see what each directive does and what it fails to protect. Flags unsafe-inline, wildcards and missing directives.Open tool
- Cache-Control AnalyzerPaste a Cache-Control header to see what a browser and a CDN will each actually do with it, and which directives contradict each other.Open tool
- JWT VerifierVerify a JWT signature against your HMAC secret, in your browser. The secret never leaves your machine, because there is no server to send it to.Open tool
- ULID GeneratorGenerate ULIDs in bulk, monotonic or random, and decode any ULID to its timestamp, randomness and UUID form. Follows the spec, overflow rules included.Open tool
- cURL to CodeConvert a curl command to Python requests, JavaScript fetch, Node.js, Go or PHP. Reads Chrome's Copy as cURL output, $'...' quoting included, in your browser.Open tool
- Bcrypt GeneratorGenerate and verify bcrypt hashes in your browser at any cost from 4 to 31, with a warning when a password runs past bcrypt’s 72-byte limit. Nothing is uploaded.Open tool
- Htpasswd GeneratorCreate htpasswd lines for Apache and nginx basic auth with bcrypt, apr1 or SHA-1, and check a password against an existing line. Runs in your browser.Open tool
- Random String GeneratorGenerate random strings, API keys and tokens from any alphabet or as random bytes in hex or base64url, with no modulo bias and the entropy in bits shown.Open tool
- User Agent ParserParse a user agent string into browser, engine, OS, device and bot, with frozen values marked as frozen and the Client Hints that carry the real ones.Open tool
- HMAC GeneratorGenerate and check HMAC-SHA256, SHA-1, SHA-384 and SHA-512 signatures, with presets for Stripe, GitHub and Slack webhooks. Runs in your browser.Open tool
- TOTP GeneratorGenerate and check TOTP codes from a Base32 secret or an otpauth:// URI, with the previous and next codes and a live countdown. RFC 6238, in your browser.Open tool
- JWT GeneratorCreate and sign JWTs with HS256, HS384, HS512, RS256, PS256 or ES256, with iat and exp helpers and key pairs made in your browser. Nothing is uploaded.Open tool