TOTP Code Generator & Tester

Password Generator builds a random password from a character pool you choose, drawing each character from the browser's cryptographic random source (crypto.getRandomValues) rather than Math.random. Set the length anywhere from 4 to 128 with the slider — the default is 16 — and toggle uppercase, lowercase, digits and symbols; the symbol set is fixed at !@#$%^&*()-_=+[]{};:,.<>?. A rough Weak / Medium / Strong label reacts to the length and how many character types are switched on, but it does not inspect patterns or check dictionaries. Nothing is transmitted or saved: a generated password exists only until you create the next one or leave the page, so copy it straight into a password manager. The tool does not compare the result against known-breach lists or estimate how long it would take to crack.

JWT Decoder & Inspector reads a compact JSON Web Token in your browser and shows you what is inside it. A compact JWT has three parts separated by dots — a header, a payload, and a signature — and each of the first two parts is a base64url-encoded JSON object. This tool splits the token, decodes the header and payload, pretty-prints both as JSON, and lists the registered claims defined by RFC 7519: iss (issuer), sub (subject), aud (audience), exp (expiration time), nbf (not valid before), iat (issued at), and jti (JWT ID), alongside any custom claims the token carries. The three time claims exp, nbf, and iat are also converted from their NumericDate seconds into a readable UTC date and your local time, and a plain time-status line tells you whether the token is expired, not yet valid, currently inside its declared window, or has no expiration claim at all. Those checks use your own device's clock. The signature part is displayed as its original base64url string and, when it decodes, its length in bytes, but it is never checked: this version does no signature verification and never asks for a secret or a key. Reading a token is not the same as verifying it — decoding shows what a token claims, not who issued it or whether it can be trusted, and a token that declares alg=none simply carries no signature at all. Remember that a standard signed JWT payload is encoded, not encrypted, so anyone holding the token can read the same claims you see here. Everything runs locally: the token you paste is never uploaded, logged, or stored anywhere. Unlike the Password Generator, which creates human passwords, the Secure Token Generator, which produces random secrets, or the SHA Hash Generator and Base64 tools, which transform arbitrary data, this tool only parses the structure of a token that already exists.

HMAC Generator computes a keyed-hash message authentication code in your browser. You give it a message and a shared secret key, pick HMAC-SHA-256, HMAC-SHA-384, or HMAC-SHA-512, and it returns the authentication code in two forms at once: lowercase hexadecimal and standard Base64. Both the message and the key are read as UTF-8 text, so accents, non-Latin scripts, and emoji are handled correctly. The result is deterministic: the same message, the same key, and the same algorithm always produce the same code, and changing a single character of either input changes the whole output. HMAC is built on a hash function but, unlike a plain hash, it mixes in a secret key — so it lets someone who holds the same secret check that a message was created or approved by a party that also holds it, and that it was not altered in transit. An empty message is accepted (it has a valid HMAC); an empty key is not, because the key is the whole point. HMAC does not encrypt the message: the message text is never hidden or transformed, only summarised into a fixed-length code. A matching HMAC only shows equivalence relative to the key and message used; whether that means anything depends entirely on how the shared secret is generated, distributed, and stored. Everything runs locally through the browser's Web Crypto API — the message, the key, and the code are never uploaded, logged, or stored anywhere. Unlike the SHA Hash Generator, which hashes text with no key, the Secure Token Generator, which produces random secrets, or the JWT Decoder, which inspects an existing token, this tool takes a message plus a key and returns one keyed authenticator.

Passphrase Generator builds a Diceware-style passphrase in your browser: a short sequence of common words chosen at random, which is usually easier to remember and to type than a string of random characters. It draws from the EFF Large Wordlist, a fixed list of 7,776 English words published by the Electronic Frontier Foundation and used here under the CC BY 3.0 licence. You choose how many words you want (4 to 10, default 6), the separator between them (hyphen, space, underscore, or dot), and whether each word stays lowercase or has its first letter capitalised. Each word is picked independently using the browser's cryptographically secure random number generator, with replacement — so the same word can occasionally appear twice, exactly as classic Diceware allows, and the list is never de-duplicated at run time. The tool shows a factual estimate of the random-selection entropy, computed as the number of words multiplied by the base-2 logarithm of the wordlist size (about 12.9 bits per word for 7,776 words, so roughly 77.5 bits for six words). That figure only describes the size of the space of uniform, independent draws from this list; it is not a crack-time estimate, it says nothing about how you store or reuse the passphrase, and a passphrase is not automatically safe just because it has more words. Nothing is sent anywhere: the wordlist is bundled with the page, generation happens entirely in your browser, and the passphrase, the options, and the entropy figure are never uploaded, logged, or stored. Unlike the Password Generator, which builds a string of random characters, the Secure Token Generator, which produces random bytes for technical secrets, the JWT Decoder, which inspects an existing token, or the HMAC Generator, which authenticates a message with a key, this tool assembles independently chosen dictionary words.