Security & Hashing Tools — JWT, MD5, SHA-256

Best free security & hashing tools for 2026

The security tools cluster covers the two operations every backend / API developer reaches for daily: token inspection (JWT decode/generate) and integrity verification (cryptographic hashes). Both are operations where uploading your data to a third-party server would be a confidentiality violation — production JWTs contain PII, and hash inputs are often unreleased file builds. Every tool in this cluster runs the cryptographic operation in the browser via the Web Crypto API, the same NIST-validated implementation that powers HTTPS in Chrome, Firefox, and Safari. Source code never leaves the page.

What's the difference between encoding, hashing, and signing?

Three operations frequently confused, with security consequences when mixed up. Encoding (Base64, URL-encoding) is reversible and uses no key — anyone can decode. JWTs are encoded, not encrypted. Hashing (MD5, SHA-256, BLAKE3) is one-way — same input always produces same output, but you can't reverse the hash. Used for integrity (file checksums), fingerprinting, deduplication, and password storage (with salt + slow KDF). Signing (HMAC-SHA, RSA-PKCS, ECDSA) combines hashing with a key — produces a tag that proves "the holder of the secret key signed this message". JWTs are signed, not encrypted by default. Mixing these up is the #1 root cause of broken auth flows.

How do I generate or decode a JWT online without uploading the token?

Both JWT Decoder and JWT Generator on this site run entirely client-side. Decoder uses native atob + JSON.parse on the Base64URL parts. Generator uses crypto.subtle.sign('HMAC', key, data) for HS-family algorithms or crypto.subtle.sign('RSASSA-PKCS1-v1_5', privateKey, data) for RS-family. The token, the secret, and the private key all stay in the browser tab. Verify by opening DevTools → Network tab and observing zero outgoing requests on decode / sign. Critical security warning: never paste a production signing secret into any online tool. Use HS256 generators only for local development tokens, dummy claims for unit tests, or short-lived debugging tokens with throwaway secrets.

Security cluster — pick the right tool

For the deeper auth pattern story — OAuth2.1, OpenID Connect, refresh tokens, key rotation — read the API Authentication Guide.

Which security tool should you use?

Security tools here cover the everyday auth-and-integrity tasks: inspecting JWTs from your auth provider, generating hashes for file integrity or password storage research, and minting tokens for local testing. None of these are substitutes for a real auth library or KMS — they're for debugging, learning, and one-off checks. Everything runs locally; tokens and inputs never leave your browser.

• Decode a JWT to inspect claims, expiration, issuer (debug auth flows, OAuth bearer tokens) — use JWT Decoder & Inspector.
• Generate a JWT for local testing with custom claims and HMAC-SHA256 signing — use JWT Generator. Never use this for production secrets.
• Compute MD5/SHA-1/SHA-256/SHA-512 of text or a file for checksum verification, ETags, cache keys — use Hash Generator.
• Generate a strong random password for a service account — use Password Generator (in our Generation hub).

Common security mistakes to avoid

• Storing passwords as MD5 or SHA-256. Both are too fast — attackers crack billions/sec. Use bcrypt, argon2id, or scrypt on the server. Hash generators here are for integrity, not password storage.
• Trusting JWT payload data without verifying the signature. Anyone can forge a JWT body. Always verify the signature on the server with the issuer's public key (or HMAC secret).
• Embedding secrets in JWT payloads. JWT bodies are Base64-encoded, not encrypted. Anyone with the token reads the contents.
• Using HS256 with a short secret. A weak HMAC key (under 32 bytes random) is brute-forceable. Use 256-bit random keys, or switch to RS256/ES256 for asymmetric signing.
• Forgetting to set exp on JWTs. Tokens without expiration live forever — a leaked token is a permanent compromise. Always set exp; rotate refresh tokens regularly.