Security & Hashing Tools

Hashes, HMACs and JWTs sit at the center of authentication and data-integrity work. Debugging them usually means comparing a value your code produced against a known-good one. These tools give you that reference value without installing anything or writing a script.

Use the SHA generator to hash text or a text file with SHA-1, SHA-256, SHA-384 or SHA-512, for checksums, cache keys and signature debugging. For a binary download, run sha256sum or shasum locally. The HMAC generator combines a secret key with a message to produce the keyed signatures that webhook providers such as Stripe, GitHub and Shopify send. The JWT decoder splits a token into header, payload and signature, pretty-prints the claims, and can verify an HS256, HS384 or HS512 signature with your secret. The JWT generator does the reverse: it builds a token from custom claims and a secret for testing an API.

Two more cover opposite ends. The MD5 generator exists because plenty of systems still use MD5 for checksums and cache keys. Do not use MD5 for anything that has to resist tampering; it is broken for that, and the page says so. The bcrypt generator is the opposite case: deliberately slow, salted, and the right way to store a password. Its verify mode helps you work out why a login that should succeed does not.

These tools hash and sign with the Web Crypto API inside your browser, so your secrets and tokens never cross the network. We built them this way because a security tool that uploads your keys defeats its own purpose.

Which tool for which job

  • Hash a string for a cache key or compare it with a known checksum

    SHA Hash Generator. SHA-256 is the usual default. SHA-1 is there for older systems that still expect it.

  • Verify a webhook signature from Stripe, GitHub or Shopify

    HMAC Generator. Compute the HMAC of the payload the provider signed, using your signing secret, and compare it with the signature header.

  • See what is inside a JWT

    JWT Decoder. The header and claims are decoded and pretty-printed, and you can verify an HS256, HS384 or HS512 signature with your secret.

  • Create a token to test an API

    JWT Generator. Set your own claims and secret and get a signed HS256 token.

  • Store or check a user's password

    Bcrypt Generator & Checker. Bcrypt is slow on purpose and salts every hash. Verify mode tells you whether a password matches a stored hash.

  • Match a checksum from a system that still uses MD5

    MD5 Hash Generator. Use it for compatibility only. MD5 collisions can be produced on an ordinary laptop, so a matching MD5 cannot prove a file was left untouched.

  • Check when a certificate expires and which hostnames it covers

    SSL Certificate Decoder (X.509 / PEM). Paste a PEM certificate or a full chain to read the subject alternative names, the validity dates and the key type.

  • Issue API keys for your own service

    API Key Generator. A prefix makes leaked keys easy to recognize in logs and code, and the page gives you the SHA-256 hash to store in place of the key.

  • Build or read an HTTP Basic Authorization header

    Basic Auth Header Generator. The header is the Base64 of user:password. Anyone who sees it can decode it, so send it over HTTPS only.

Other tool categories

Specifications and references

This tool follows the specifications below. Read them when you need the exact normative wording, for example to settle an edge case between two implementations.

Frequently Asked Questions

Which hash should I use for passwords?

Use a slow, salted password hash such as bcrypt, scrypt or Argon2. SHA-256 and MD5 are designed to be fast, so an attacker with a leaked database can try billions of guesses per second on one GPU. Bcrypt's cost factor makes each guess expensive, and the salt stops one guess from being tested against every account at once.

What is the difference between a hash and an HMAC?

Anyone can compute a plain hash, so an attacker who changes a message can recompute its SHA-256 as well. An HMAC mixes in a secret key, so only someone who knows the key can produce a matching value. That is why webhooks and signed URLs use HMAC.

Can other people read the claims in my JWT?

Yes. The header and payload are only base64url-encoded, so anyone holding the token can read them. The signature stops them from changing the claims without being detected. Keep secrets and personal data out of the payload, or use an encrypted JWE when the claims must stay private.

Copied to clipboard!