Password Generator

JWT Decoder & Inspector reads a compact JSON Web Token in your browser and shows you what is inside it. A compact JWT has three parts separated by dots — a header, a payload, and a signature — and each of the first two parts is a base64url-encoded JSON object. This tool splits the token, decodes the header and payload, pretty-prints both as JSON, and lists the registered claims defined by RFC 7519: iss (issuer), sub (subject), aud (audience), exp (expiration time), nbf (not valid before), iat (issued at), and jti (JWT ID), alongside any custom claims the token carries. The three time claims exp, nbf, and iat are also converted from their NumericDate seconds into a readable UTC date and your local time, and a plain time-status line tells you whether the token is expired, not yet valid, currently inside its declared window, or has no expiration claim at all. Those checks use your own device's clock. The signature part is displayed as its original base64url string and, when it decodes, its length in bytes, but it is never checked: this version does no signature verification and never asks for a secret or a key. Reading a token is not the same as verifying it — decoding shows what a token claims, not who issued it or whether it can be trusted, and a token that declares alg=none simply carries no signature at all. Remember that a standard signed JWT payload is encoded, not encrypted, so anyone holding the token can read the same claims you see here. Everything runs locally: the token you paste is never uploaded, logged, or stored anywhere. Unlike the Password Generator, which creates human passwords, the Secure Token Generator, which produces random secrets, or the SHA Hash Generator and Base64 tools, which transform arbitrary data, this tool only parses the structure of a token that already exists.

HMAC Generator computes a keyed-hash message authentication code in your browser. You give it a message and a shared secret key, pick HMAC-SHA-256, HMAC-SHA-384, or HMAC-SHA-512, and it returns the authentication code in two forms at once: lowercase hexadecimal and standard Base64. Both the message and the key are read as UTF-8 text, so accents, non-Latin scripts, and emoji are handled correctly. The result is deterministic: the same message, the same key, and the same algorithm always produce the same code, and changing a single character of either input changes the whole output. HMAC is built on a hash function but, unlike a plain hash, it mixes in a secret key — so it lets someone who holds the same secret check that a message was created or approved by a party that also holds it, and that it was not altered in transit. An empty message is accepted (it has a valid HMAC); an empty key is not, because the key is the whole point. HMAC does not encrypt the message: the message text is never hidden or transformed, only summarised into a fixed-length code. A matching HMAC only shows equivalence relative to the key and message used; whether that means anything depends entirely on how the shared secret is generated, distributed, and stored. Everything runs locally through the browser's Web Crypto API — the message, the key, and the code are never uploaded, logged, or stored anywhere. Unlike the SHA Hash Generator, which hashes text with no key, the Secure Token Generator, which produces random secrets, or the JWT Decoder, which inspects an existing token, this tool takes a message plus a key and returns one keyed authenticator.

Passphrase Generator builds a Diceware-style passphrase in your browser: a short sequence of common words chosen at random, which is usually easier to remember and to type than a string of random characters. It draws from the EFF Large Wordlist, a fixed list of 7,776 English words published by the Electronic Frontier Foundation and used here under the CC BY 3.0 licence. You choose how many words you want (4 to 10, default 6), the separator between them (hyphen, space, underscore, or dot), and whether each word stays lowercase or has its first letter capitalised. Each word is picked independently using the browser's cryptographically secure random number generator, with replacement — so the same word can occasionally appear twice, exactly as classic Diceware allows, and the list is never de-duplicated at run time. The tool shows a factual estimate of the random-selection entropy, computed as the number of words multiplied by the base-2 logarithm of the wordlist size (about 12.9 bits per word for 7,776 words, so roughly 77.5 bits for six words). That figure only describes the size of the space of uniform, independent draws from this list; it is not a crack-time estimate, it says nothing about how you store or reuse the passphrase, and a passphrase is not automatically safe just because it has more words. Nothing is sent anywhere: the wordlist is bundled with the page, generation happens entirely in your browser, and the passphrase, the options, and the entropy figure are never uploaded, logged, or stored. Unlike the Password Generator, which builds a string of random characters, the Secure Token Generator, which produces random bytes for technical secrets, the JWT Decoder, which inspects an existing token, or the HMAC Generator, which authenticates a message with a key, this tool assembles independently chosen dictionary words.

TOTP Code Generator & Tester is a local diagnostic tool for time-based one-time passwords, the six- or eight-digit codes used for two-factor authentication. It implements RFC 6238 (TOTP) on top of RFC 4226 (HOTP): you paste a Base32 secret, choose the hash algorithm (SHA-1, SHA-256, or SHA-512), the number of digits (6 or 8), and the period (30 or 60 seconds), and the tool shows the current code together with a countdown to the next one. SHA-1 is offered because RFC 6238 still references it widely for TOTP compatibility, not as a general hashing recommendation. Each code is derived by taking an HMAC of the current time counter — floor(unix time / period) — with your secret, then applying the RFC 4226 dynamic-truncation step. The codes are computed entirely in your browser using the Web Crypto API and your device's own clock; the tool does not synchronise time, so a code can differ from your authenticator app if the two clocks disagree. This tool is for testing and troubleshooting TOTP configurations. It is not a replacement for an authenticator app, not a backup for your 2FA secrets, and not a place to store account credentials: the secret lives only in the page while it is open and is never uploaded, logged, or stored. Anyone who holds the same TOTP secret can generate the same codes, so treat the secret with care. Unlike the HMAC Generator, which returns a single static keyed authenticator for a message, the Secure Token Generator, which produces random bytes, the JWT Decoder, which inspects an existing token, or the Password and Passphrase generators, which create new credentials, this tool turns a shared time-based secret into the changing numeric code expected by a 2FA verifier.