Free Online Security & Crypto Tools
Cryptographic utilities that keep your secrets on your machine
Security tools have a paradox: the moment you paste a secret into an online utility, that secret has left your control. The tools in this category solve the paradox by running every cryptographic operation locally in your browser using the native Web Crypto API. Hashes, HMAC signatures, JWT decoding and signing, and password generation all execute on your device — the input and any keys or secrets never leave the browser tab. That means you can safely use these tools with real signing secrets, real webhook payloads, and real tokens.
All Security & Crypto Tools
JWT Decoder
Decode JSON Web Tokens (JWT) to inspect the header, payload, and signature. Runs entirely in your browser — tokens are never sent to any server.
AES Encrypt / Decrypt
Encrypt and decrypt text with AES (128 / 192 / 256, GCM authenticated or CBC legacy) using a password. PBKDF2 key derivation with 200,000 iterations. 100% local — the Web Crypto API runs entirely in your browser.
RSA Key Generator
Generate RSA key pairs (2048, 3072, or 4096 bits) online for OAEP encryption, PSS signing, or RS256 JWTs. Exports PKCS#8 private key + SPKI public key as PEM, JWK, or DER (hex/base64). 100% local — the Web Crypto API runs in your browser, private keys never leave the tab.
Public Key Extractor
Paste an RSA or EC private key (PEM PKCS#8 or JWK) and instantly extract the matching public key in PEM (SPKI), JWK, or DER format. Perfect for publishing a JWKS endpoint, verifying a token against a private-key-only backup, or distributing a public key to peers. 100% local — the private key never leaves your browser.
RSA Encrypt / Decrypt
Encrypt text with an RSA public key or decrypt ciphertext with the private key, using RSA-OAEP (SHA-256/384/512). Accepts PEM (PKCS#8 / SPKI) or JWK. 100% local — keys and plaintext never leave your browser tab.
ECDSA Sign / Verify
Sign or verify messages with ECDSA (P-256, P-384, P-521) using PEM or JWK keys. Outputs both JOSE / P1363 (JWT-compatible) and DER (OpenSSL-compatible) signatures. 100% local via the Web Crypto API.
ECDSA Key Generator
Generate elliptic-curve key pairs (P-256, P-384, P-521) for ECDSA signatures or ECDH key agreement. Exports PKCS#8 / SPKI PEM, JWK, and DER (hex/base64). Perfect for ES256/ES384/ES512 JWTs. 100% local via the Web Crypto API — the private key never leaves your browser.
Hash Generator
Generate MD5, SHA-1, SHA-256, and SHA-512 hashes of any text online. Free, no signup — all hashing runs entirely in your browser via the Web Crypto API, so nothing is uploaded.
MD5 Generator
Compute MD5 hashes of text or files instantly online. Drag-and-drop file support for checksums of any size (streaming, GB-scale friendly). Verify against a known MD5 with one click. 100% local — nothing is uploaded.
SHA-1 Generator
Generate SHA-1 (160-bit) hashes of any text or file online. Drag-and-drop file support for GB-scale checksums via Web Crypto API. Verify against a known SHA-1 in one click. 100% local.
SHA-256 Generator
Compute SHA-256 (256-bit) hashes of text or files instantly online. The gold-standard cryptographic hash for signatures, blockchain, and integrity. Drag-and-drop file support; verify against a known SHA-256 in one click. 100% local.
SHA-512 Generator
Compute SHA-512 (512-bit) hashes of text or files instantly online. Provides higher security margin than SHA-256 and is faster on 64-bit hardware. Drag-and-drop file support; verify with one click. 100% local.
Password Strength
Analyze password strength free in your browser: entropy in bits, estimated crack time under four attack scenarios (online throttled/unthrottled, offline GPU fast hash, offline bcrypt slow hash), and structural findings (dictionary words, keyboard sequences, repeated patterns). Optional k-anonymous Have I Been Pwned check — no signup, your password never leaves the tab.
JWKS Generator
Assemble multiple RSA/EC public keys into a standard JSON Web Key Set (JWKS, RFC 7517). Paste PEM (public or private — private components are stripped) or JWK, then auto-generate kid via SHA-256 thumbprint (RFC 7638). Ready to host at /.well-known/jwks.json — free, no signup, 100% local.
JWT Verifier
Paste a JWT and its signing key (HMAC secret, RSA/EC public key in PEM or JWK) to verify the signature and inspect claims. Supports HS256/384/512, RS256/384/512, PS256/384/512, ES256/384/512. Also flags exp / nbf / iat time-based claims. 100% local — nothing is sent to any server.
JWT Generator
Create signed JSON Web Tokens with HS256/384/512 (HMAC), RS256/384/512 (RSA), PS256/384/512 (RSA-PSS), or ES256/384/512 (ECDSA). Paste a raw secret, a PEM private key, or a JWK — signing runs entirely in your browser via the Web Crypto API.
HMAC Generator
Compute HMAC signatures with SHA-1, SHA-256, SHA-384, or SHA-512 online. Verify API requests, sign webhooks, and authenticate messages. Free, no signup — signing runs locally via the Web Crypto API, secrets never leave your browser.
HMAC-SHA256
Compute HMAC-SHA256 signatures with any secret key. Outputs hex, base64, and base64url encodings. Verify a signature against an expected value in one click. Used by AWS SigV4, JWT HS256, Stripe / GitHub / Slack webhooks. 100% local via Web Crypto API.
Bcrypt Generator
Generate and verify bcrypt password hashes online. Configurable cost factor (4–15), shows computation time so you can pick a cost matching your server hardware. Parses and displays hash version and cost from any pasted hash. 100% local — passwords never leave your browser.
HMAC-SHA1
Compute HMAC-SHA1 signatures with any secret key. Outputs hex, base64, and base64url. Still used by OAuth 1.0, AWS S3 signature v2, and some older webhook schemes. 100% local via Web Crypto API.
OTP Generator
Generate time-based one-time passwords (TOTP RFC 6238) from a Base32 secret. Real-time counter with 30-second expiry. Perfect for 2FA testing and authenticator app debugging. 100% local.
When to use these tools
Use these tools to verify webhook signatures, hash a value for a fingerprint, generate a strong per-account password, decode a JWT to inspect its claims, or reproduce a signing step while debugging an integration.
Frequently Asked Questions
Is my secret or token sent to your server?
No. Every operation uses the browser's native Web Crypto API and runs on your device. Neither inputs nor keys leave your browser tab.
Can I use MD5 or SHA-1 for passwords?
No. MD5 and SHA-1 are broken as password hashes. Use a dedicated password-hashing function like bcrypt, scrypt, or Argon2 with a per-user salt. Fast hashes are only appropriate for fingerprints and non-secret integrity checks.
Which algorithm should I pick for HMAC?
SHA-256 (HS256) is the modern default and is what AWS SigV4, most webhook signatures, and JWT HS256 use. Choose SHA-384 or SHA-512 only when a specification requires a longer digest.