Passphrase Generator

Password Generator builds a random password from a character pool you choose, drawing each character from the browser's cryptographic random source (crypto.getRandomValues) rather than Math.random. Set the length anywhere from 4 to 128 with the slider — the default is 16 — and toggle uppercase, lowercase, digits and symbols; the symbol set is fixed at !@#$%^&*()-_=+[]{};:,.<>?. A rough Weak / Medium / Strong label reacts to the length and how many character types are switched on, but it does not inspect patterns or check dictionaries. Nothing is transmitted or saved: a generated password exists only until you create the next one or leave the page, so copy it straight into a password manager. The tool does not compare the result against known-breach lists or estimate how long it would take to crack.

JWT Decoder & Inspector reads a compact JSON Web Token in your browser and shows you what is inside it. A compact JWT has three parts separated by dots — a header, a payload, and a signature — and each of the first two parts is a base64url-encoded JSON object. This tool splits the token, decodes the header and payload, pretty-prints both as JSON, and lists the registered claims defined by RFC 7519: iss (issuer), sub (subject), aud (audience), exp (expiration time), nbf (not valid before), iat (issued at), and jti (JWT ID), alongside any custom claims the token carries. The three time claims exp, nbf, and iat are also converted from their NumericDate seconds into a readable UTC date and your local time, and a plain time-status line tells you whether the token is expired, not yet valid, currently inside its declared window, or has no expiration claim at all. Those checks use your own device's clock. The signature part is displayed as its original base64url string and, when it decodes, its length in bytes, but it is never checked: this version does no signature verification and never asks for a secret or a key. Reading a token is not the same as verifying it — decoding shows what a token claims, not who issued it or whether it can be trusted, and a token that declares alg=none simply carries no signature at all. Remember that a standard signed JWT payload is encoded, not encrypted, so anyone holding the token can read the same claims you see here. Everything runs locally: the token you paste is never uploaded, logged, or stored anywhere. Unlike the Password Generator, which creates human passwords, the Secure Token Generator, which produces random secrets, or the SHA Hash Generator and Base64 tools, which transform arbitrary data, this tool only parses the structure of a token that already exists.

HMAC Generator computes a keyed-hash message authentication code in your browser. You give it a message and a shared secret key, pick HMAC-SHA-256, HMAC-SHA-384, or HMAC-SHA-512, and it returns the authentication code in two forms at once: lowercase hexadecimal and standard Base64. Both the message and the key are read as UTF-8 text, so accents, non-Latin scripts, and emoji are handled correctly. The result is deterministic: the same message, the same key, and the same algorithm always produce the same code, and changing a single character of either input changes the whole output. HMAC is built on a hash function but, unlike a plain hash, it mixes in a secret key — so it lets someone who holds the same secret check that a message was created or approved by a party that also holds it, and that it was not altered in transit. An empty message is accepted (it has a valid HMAC); an empty key is not, because the key is the whole point. HMAC does not encrypt the message: the message text is never hidden or transformed, only summarised into a fixed-length code. A matching HMAC only shows equivalence relative to the key and message used; whether that means anything depends entirely on how the shared secret is generated, distributed, and stored. Everything runs locally through the browser's Web Crypto API — the message, the key, and the code are never uploaded, logged, or stored anywhere. Unlike the SHA Hash Generator, which hashes text with no key, the Secure Token Generator, which produces random secrets, or the JWT Decoder, which inspects an existing token, this tool takes a message plus a key and returns one keyed authenticator.

TOTP Code Generator & Tester is a local diagnostic tool for time-based one-time passwords, the six- or eight-digit codes used for two-factor authentication. It implements RFC 6238 (TOTP) on top of RFC 4226 (HOTP): you paste a Base32 secret, choose the hash algorithm (SHA-1, SHA-256, or SHA-512), the number of digits (6 or 8), and the period (30 or 60 seconds), and the tool shows the current code together with a countdown to the next one. SHA-1 is offered because RFC 6238 still references it widely for TOTP compatibility, not as a general hashing recommendation. Each code is derived by taking an HMAC of the current time counter — floor(unix time / period) — with your secret, then applying the RFC 4226 dynamic-truncation step. The codes are computed entirely in your browser using the Web Crypto API and your device's own clock; the tool does not synchronise time, so a code can differ from your authenticator app if the two clocks disagree. This tool is for testing and troubleshooting TOTP configurations. It is not a replacement for an authenticator app, not a backup for your 2FA secrets, and not a place to store account credentials: the secret lives only in the page while it is open and is never uploaded, logged, or stored. Anyone who holds the same TOTP secret can generate the same codes, so treat the secret with care. Unlike the HMAC Generator, which returns a single static keyed authenticator for a message, the Secure Token Generator, which produces random bytes, the JWT Decoder, which inspects an existing token, or the Password and Passphrase generators, which create new credentials, this tool turns a shared time-based secret into the changing numeric code expected by a 2FA verifier.