Security & Hashing Tools

Hashes, HMACs and JWTs sit at the center of authentication and data-integrity work. Debugging them usually means comparing a value your code produced against a known-good one. These tools give you that reference value without installing anything or writing a script.

Use the SHA generator to hash text or a text file with SHA-1, SHA-256, SHA-384 or SHA-512, for checksums, cache keys and signature debugging. For a binary download, run sha256sum or shasum locally. The HMAC generator combines a secret key with a message to produce the keyed signatures that webhook providers such as Stripe, GitHub and Shopify send. The JWT decoder splits a token into header, payload and signature, pretty-prints the claims, and can verify an HS256, HS384 or HS512 signature with your secret. The JWT generator does the reverse: it builds a token from custom claims and a secret for testing an API.

Two more cover opposite ends. The MD5 generator exists because plenty of systems still use MD5 for checksums and cache keys. Do not use MD5 for anything that has to resist tampering; it is broken for that, and the page says so. The bcrypt generator is the opposite case: deliberately slow, salted, and the right way to store a password. Its verify mode helps you work out why a login that should succeed does not.

These tools hash and sign with the Web Crypto API inside your browser, so your secrets and tokens never cross the network. We built them this way because a security tool that uploads your keys defeats its own purpose.