Security tools

The Security category has four tools: a JWT Decoder, a UUID Generator, a Password Generator and a Hash Generator. All of them work on your device and send nothing over the network.

JWT Decoder

A JWT (JSON Web Token) is a signed piece of text that many APIs use to prove who you are. It has three parts separated by dots: a header, a payload and a signature. The first two are Base64-encoded JSON, so anyone can read them. See Auth basics.

1. Open JWT Decoder and paste the token into Input.

2. Select Decode.

3. Read the result:

   • Header: the token type and the signing algorithm.
   • Payload: the claims, such as the user, the issuer and the expiry.
   • Timestamps: appears when the payload has iat (issued at), nbf (not valid before) or exp (expires). Each is shown as a date and time in your local time zone. The exp line ends with ✓ valid or ⚠ EXPIRED.

If the text does not have exactly three dot-separated parts, the tool says so and tells you how many it found. Check that you copied the whole token and did not include the word Bearer.

WARNING

The tool shows this note under the result: Signature is not verified. Decoding only reads the contents. It does not prove that the token is genuine or that a server will accept it. "✓ valid" means only that the expiry time has not passed.

A token is a credential. The tool keeps it on your device, but treat a real token as you would a password: clear the input when you are done.

UUID Generator

A UUID is a 36-character identifier that is unique for practical purposes, such as 3f2b8c1e-7d44-4b0a-9f6e-2a1c5d8e9b70. Databases and APIs use them as record IDs.

1. Open UUID Generator and choose a version.

2. Drag Count to the number of UUIDs you want, from 1 to 50.

3. Optionally select Uppercase or Remove dashes.

4. Select Generate. The UUIDs appear one per line in Output.

Version	What it is	Choose it when
v1 (time)	Built from the current time	A system requires version 1
v4 (random)	Random. The default	You need an ID and have no other requirement
v7 (sortable)	Starts with the time, so newer IDs sort after older ones	The IDs are database keys that should stay in creation order

Password Generator

Creates a random password from the character sets you allow.

1. Open Password Generator and drag Length to a value from 6 to 64. The default is 16.

2. Choose the character sets: A–Z, a–z, 0–9 and !@#$ (symbols). All four are on at first.

3. Optionally select Exclude ambiguous (Il1O0o) to leave out characters that look alike. Use it for passwords someone will read and type.

4. Select Generate and copy the password from Output.

The bar above the button estimates the strength from the length and the character sets, and labels it:

Label	Estimated strength
Weak	Under 45 bits
Fair	45 to 69 bits
Strong	70 to 99 bits
Very strong	100 bits or more

Every generated password contains at least one character from each set you selected. If you turn every set off, the output asks you to select at least one.

Good to know

The password is not saved anywhere. When you leave the tool it is gone, so store it in your password manager straight away.

Hash Generator

A hash is a fixed-length fingerprint of some data. The same input always gives the same hash, and you cannot get the input back from it.

Open Hash Generator and type or paste text. Four results appear and update as you type, each with its own Copy icon:

Result	Length	Notes
MD5	32 hex characters	Fine for spotting accidental changes. Not safe against deliberate tampering.
SHA-1	40 hex characters	Same caution as MD5.
SHA-256	64 hex characters	The usual choice today.
SHA-512	128 hex characters	A longer alternative to SHA-256.

The tool hashes the text you enter (as UTF-8). It does not hash files. An extra space or a line break at the end of the input changes every hash, so if a result does not match what you expect, check for those first.

Do not use a plain hash from this tool to store passwords in an application. Password storage needs a purpose-built algorithm with a salt.

Next steps

• Web tools
• Auth basics
• Glossary