ToolsForWeb

Saved

Tap ☆ on any tool to keep it here.

AboutFAQContactPrivacyTerms
toolsforweb

Security

Hashing, tokens, certificates, and vulnerability scoring in your browser: JWT/JWKS tools, password generators, CSR/X.509 decoders, CVSS/SSVC calculators.

21 tools
Password GeneratorPopular

Generate a strong random password or passphrase, with its entropy in bits.

JWT Decoder

Decode a JSON Web Token's header and payload without verifying the signature.

JWKS Key Set Viewer

Decode a JWKS key set — kid, kty, alg, use, key_ops, x5c chains — and convert JWK ↔ PEM.

Basic Auth Header Generator

Build an Authorization: Basic header (RFC 7617), or decode one back to user and password.

JWT Generator

Sign a JWT with HS256 in your browser — custom claims, expiry and iat.

Hash Generator

Generate MD5, SHA-1, SHA-256, SHA-384 and SHA-512 digests of text.

Hash Identifier

Identify the likely algorithm behind a hash from its format and length.

CVSS Calculator

Score a vulnerability with CVSS v3.1 or v4.0 base metrics, or decode a vector string.

X.509 Certificate Decoder

Decode a PEM certificate to read its subject, issuer, validity, SANs and fingerprints.

Bcrypt Generator & Verifier

Hash a password with bcrypt or check a password against a bcrypt hash — in your browser.

TOTP Code Generator

Generate live 2FA codes from a base32 secret, with countdown, drift checking and otpauth:// parsing.

CSR Decoder

Decode a PKCS#10 certificate signing request to check its subject and SANs before you submit it.

HMAC Generator

Compute an HMAC over a message with a secret key using SHA-1, SHA-256, SHA-384 or SHA-512.

Email Header Analyzer

Parse email headers to trace the Received chain and read the SPF, DKIM and DMARC verdicts.

File Checksum Verifier

Hash a downloaded file with MD5 or SHA and compare it against the published checksum.

Password Entropy Calculator

Estimate a password's entropy in bits from its length and character set, with a crack-time ballpark.

security.txt Generator

Build a valid /.well-known/security.txt file (RFC 9116) from a short form.

SSVC Calculator

Prioritize a vulnerability with the CISA SSVC decision tree — Track, Track*, Attend or Act.

Content-Security-Policy Analyzer

Parse a Content-Security-Policy header into its directives and flag weak or missing protections.

Content-Security-Policy Generator

Compose a Content-Security-Policy from directives and get the header value plus Nginx, Apache and Next.js snippets.

SafeLinks & URL Wrapper Decoder

Recover the original URL from a Microsoft SafeLinks, Proofpoint or Barracuda rewritten link.

About Security

Security utilities that run in your browser, so tokens, keys and passwords never leave the page. Decode a JWT and inspect its claims, sign a test token with HS256, and inspect a JWKS key set with JWK to PEM conversion. Generate strong passwords or passphrases with their entropy, hash text with MD5, SHA-1 or SHA-2, compute HMACs, identify an unknown hash, create and verify bcrypt hashes, and generate TOTP codes.

For certificates and incident work, decode X.509 certificates and CSRs, verify a downloaded file against its checksum, trace an email's route and authentication results from its headers, and unwrap SafeLinks and other rewritten URLs. Score vulnerabilities with the CVSS and SSVC calculators, generate and analyze Content-Security-Policy headers, and generate a security.txt file.

Questions

Is it safe to paste a JWT into an online decoder?

Only if the decoder runs locally. This one decodes in your browser and sends nothing to a server. A JWT's payload is only base64url-encoded, not encrypted, so anyone who holds the token can read it; treat live tokens like passwords.

Is MD5 or SHA-1 safe for passwords?

No. They are fast hashes, which makes brute-forcing easy, and both have known collision attacks. Store passwords with a slow, salted algorithm such as bcrypt or Argon2. MD5 and SHA-1 are still fine for non-security checksums.

How long should a password be?

Aim for around 80 bits of entropy or more: about 13 random characters drawn from upper and lower case, digits and symbols, or an 8-word passphrase from a 1,000-word list. The password generator shows the entropy of every result so you can compare.