Code Beautifier

Security & Auth

Every tool in this pillar touches something sensitive: a token, a private key, a certificate, a password. That is exactly why they run in the browser, and why the credential tools here save nothing at all. No draft, no history, no share link, nothing written to local storage, and the pages that handle secrets say so in a banner. Reading a token and trusting a token are different operations, and most mistakes in this area come from confusing the two.

Tools (13)

JWT Decoder
Decode JSON Web Tokens (JWT) client-side. Inspect header claims, payload data, expiration times, and token signatures.
JWT Generator
Generate and sign JSON Web Tokens (JWT) using HMAC-SHA256, HMAC-SHA384, or HMAC-SHA512.
JWE Decoder
Decrypt JSON Web Encryption (JWE) tokens with your own key, or inspect and validate them without one. Everything runs in your browser.
Hash Generator
Generate cryptographically secure SHA-256, SHA-512, SHA-1, and MD5 message digests client-side.
Bcrypt Hash Generator & Verifier
Generate secure salted Bcrypt password hashes ($2a$) or verify plaintext passwords against existing hashes locally.
Certificate & JWK Inspector
Inspect X.509 PEM certificates, CSRs, private-key fingerprints, and JSON Web Keys locally — without uploading.
HTTP Headers & Security Inspector
Parse HTTP headers, audit critical security headers (HSTS, CSP, X-Frame-Options, CORS), and calculate a security grade.
IP Subnet & CIDR Calculator
Calculate network range, broadcast IP, usable hosts, subnet mask, wildcard mask, and binary breakdown from any CIDR notation.
Password Generator
Generate strong random passwords and EFF wordlist passphrases in your browser, with the entropy of each shown in bits.
HMAC Generator
Compute HMAC signatures for webhooks and API requests, with the key as UTF-8 text, hex, or Base64, and output as hex or Base64.
AES Encrypt & Decrypt
Encrypt and decrypt text with AES-256-GCM and a key derived from your passphrase with PBKDF2-SHA256, entirely in your browser.
RSA, ECDSA & Ed25519 Key Generator
Generate a key pair in your browser with Web Crypto and export it as PEM or JWK, with a SHA-256 fingerprint of the public key.
TOTP Code Generator
Generate the current two-factor code from a Base32 secret or otpauth:// URI, with the previous and next codes for clock skew.

Decoding is not verifying

JWT Decoder shows the header and claims of a token, but decoding proves nothing. The payload is base64url, not encrypted, so anyone can read it and anyone can craft one. Only a signature check against the issuer's secret or public key establishes trust, which is the job of JWT Generator and HMAC Generator. Treat a decoded payload as a claim somebody made, never as a fact your backend can act on.

Generating keys, passwords and one-time codes

Password Generator draws from the browser's cryptographic random source using rejection sampling rather than a modulo, which would quietly favour the first characters of the alphabet, and it reports entropy so a passphrase can be compared honestly against a random string. RSA, ECDSA and Ed25519 Key Generator produces real key pairs through Web Crypto, and TOTP Generator implements RFC 6238 for testing an authenticator flow end to end.

Inspecting what a server actually sends

HTTP Headers Inspector grades a response against the headers that matter, including HSTS, Content-Security-Policy, X-Frame-Options and Referrer-Policy, and keeps repeated headers such as Set-Cookie as a list instead of letting the last one overwrite the rest. Certificate Inspector reads a PEM certificate's subject, issuer, validity window and fingerprint without a round trip to an online checker. IP Subnet Calculator works out network and broadcast ranges when you are scoping a firewall rule or an allowlist.

Cheat sheets

JWT Claims Cheat Sheet
Registered, public, and private claims for JSON Web Tokens
HTTP Security Headers Cheat Sheet
HSTS, CSP, framing, MIME sniffing, Referrer-Policy, and CORS
HTTP Status Codes & Headers Reference
Complete reference for 1xx, 2xx, 3xx, 4xx, and 5xx response codes and caching headers

Guides

HTTP security headers in plain English
What HSTS, CSP, X-Frame-Options, Referrer-Policy and Permissions-Policy each prevent, safe default values, and how to check a live response.
JWT security mistakes that show up in every pentest
The alg:none bypass, HS256/RS256 confusion, unverified signatures and missing expiry checks: what goes wrong with JWTs and how to avoid it.

FAQ

Does decoding a JWT tell me whether it is valid?

No. Decoding only reveals what the token claims, because the payload is base64url rather than encrypted. Validity depends on checking the signature against the issuing key, plus the expiry and audience claims, on the server that trusts it.

Do the credential tools keep anything in my browser?

No. Tools flagged as sensitive skip drafts, input history, share links and workspace saves entirely, and they purge any keys left by earlier visits. Nothing you type on them is written to local storage or sent to the sharing API.

Is a generated passphrase stronger than a random string?

It depends on the entropy, not on how it looks. A six-word passphrase from a 1,296-word list carries about 62 bits, which the generator reports so you can compare it directly against a random string of a given length and alphabet.

Can I inspect a certificate without using an online checker?

Yes, and you should prefer to. Certificate Inspector parses the PEM locally and shows subject, issuer, validity dates and fingerprint, so a certificate never has to be uploaded to a third party to be read.