HMAC Generator

Password Generator builds a random password from a character pool you choose, drawing each character from the browser's cryptographic random source (crypto.getRandomValues) rather than Math.random. Set the length anywhere from 4 to 128 with the slider — the default is 16 — and toggle uppercase, lowercase, digits and symbols; the symbol set is fixed at !@#$%^&*()-_=+[]{};:,.<>?. A rough Weak / Medium / Strong label reacts to the length and how many character types are switched on, but it does not inspect patterns or check dictionaries. Nothing is transmitted or saved: a generated password exists only until you create the next one or leave the page, so copy it straight into a password manager. The tool does not compare the result against known-breach lists or estimate how long it would take to crack.

JWT Decoder & Inspector reads a compact JSON Web Token in your browser and shows you what is inside it. A compact JWT has three parts separated by dots — a header, a payload, and a signature — and each of the first two parts is a base64url-encoded JSON object. This tool splits the token, decodes the header and payload, pretty-prints both as JSON, and lists the registered claims defined by RFC 7519: iss (issuer), sub (subject), aud (audience), exp (expiration time), nbf (not valid before), iat (issued at), and jti (JWT ID), alongside any custom claims the token carries. The three time claims exp, nbf, and iat are also converted from their NumericDate seconds into a readable UTC date and your local time, and a plain time-status line tells you whether the token is expired, not yet valid, currently inside its declared window, or has no expiration claim at all. Those checks use your own device's clock. The signature part is displayed as its original base64url string and, when it decodes, its length in bytes, but it is never checked: this version does no signature verification and never asks for a secret or a key. Reading a token is not the same as verifying it — decoding shows what a token claims, not who issued it or whether it can be trusted, and a token that declares alg=none simply carries no signature at all. Remember that a standard signed JWT payload is encoded, not encrypted, so anyone holding the token can read the same claims you see here. Everything runs locally: the token you paste is never uploaded, logged, or stored anywhere. Unlike the Password Generator, which creates human passwords, the Secure Token Generator, which produces random secrets, or the SHA Hash Generator and Base64 tools, which transform arbitrary data, this tool only parses the structure of a token that already exists.

Passphrase Generator builds a Diceware-style passphrase in your browser: a short sequence of common words chosen at random, which is usually easier to remember and to type than a string of random characters. It draws from the EFF Large Wordlist, a fixed list of 7,776 English words published by the Electronic Frontier Foundation and used here under the CC BY 3.0 licence. You choose how many words you want (4 to 10, default 6), the separator between them (hyphen, space, underscore, or dot), and whether each word stays lowercase or has its first letter capitalised. Each word is picked independently using the browser's cryptographically secure random number generator, with replacement — so the same word can occasionally appear twice, exactly as classic Diceware allows, and the list is never de-duplicated at run time. The tool shows a factual estimate of the random-selection entropy, computed as the number of words multiplied by the base-2 logarithm of the wordlist size (about 12.9 bits per word for 7,776 words, so roughly 77.5 bits for six words). That figure only describes the size of the space of uniform, independent draws from this list; it is not a crack-time estimate, it says nothing about how you store or reuse the passphrase, and a passphrase is not automatically safe just because it has more words. Nothing is sent anywhere: the wordlist is bundled with the page, generation happens entirely in your browser, and the passphrase, the options, and the entropy figure are never uploaded, logged, or stored. Unlike the Password Generator, which builds a string of random characters, the Secure Token Generator, which produces random bytes for technical secrets, the JWT Decoder, which inspects an existing token, or the HMAC Generator, which authenticates a message with a key, this tool assembles independently chosen dictionary words.

TOTP Code Generator & Tester is a local diagnostic tool for time-based one-time passwords, the six- or eight-digit codes used for two-factor authentication. It implements RFC 6238 (TOTP) on top of RFC 4226 (HOTP): you paste a Base32 secret, choose the hash algorithm (SHA-1, SHA-256, or SHA-512), the number of digits (6 or 8), and the period (30 or 60 seconds), and the tool shows the current code together with a countdown to the next one. SHA-1 is offered because RFC 6238 still references it widely for TOTP compatibility, not as a general hashing recommendation. Each code is derived by taking an HMAC of the current time counter — floor(unix time / period) — with your secret, then applying the RFC 4226 dynamic-truncation step. The codes are computed entirely in your browser using the Web Crypto API and your device's own clock; the tool does not synchronise time, so a code can differ from your authenticator app if the two clocks disagree. This tool is for testing and troubleshooting TOTP configurations. It is not a replacement for an authenticator app, not a backup for your 2FA secrets, and not a place to store account credentials: the secret lives only in the page while it is open and is never uploaded, logged, or stored. Anyone who holds the same TOTP secret can generate the same codes, so treat the secret with care. Unlike the HMAC Generator, which returns a single static keyed authenticator for a message, the Secure Token Generator, which produces random bytes, the JWT Decoder, which inspects an existing token, or the Password and Passphrase generators, which create new credentials, this tool turns a shared time-based secret into the changing numeric code expected by a 2FA verifier.