Security work gets messy when every unknown string is treated the same. A JWT, a certificate block, a payment card number, and a downloaded file hash all deserve different questions.
Toolcore's Security tools are useful because they keep those questions separate. You can decode, hash, inspect, validate, or generate locally without turning the first step into a production integration.
When the string is a token, ask what kind of trust you need
A JWT is readable even when it is not trustworthy. JWT decode shows the header and payload so you can inspect claims, expiry, and shape. It does not prove the token should be accepted.
If your task is signing or verification with a key, use the JWT signing and verification pages instead. Keep the difference clear: decode explains, while verify checks a cryptographic claim.
When the question is integrity, use a hash or checksum
Use hash and crypto tools when you need SHA, HMAC, or a text digest. Use File checksum when you are verifying a download against a value posted on a release page.
HMAC is not just a hash. It uses a secret key and is common in webhook signatures. If the docs say "calculate HMAC-SHA256," do not compare it to a plain SHA-256 digest and wonder why it differs.
When the text has BEGIN and END lines, inspect the PEM blocks
A pasted certificate chain or key file is easier to understand once you know how many blocks it contains. PEM block inspector lists certificate and key blocks, base64 sizes, and labels without uploading the text.
That is enough for many triage tasks: "Did I paste the full chain?" "Is this a certificate or a private key?" "Why is this file much larger than expected?"
When you are testing auth flows, generate the right helper value
OAuth PKCE needs a verifier and challenge pair. Two-factor debugging may need a TOTP code from a Base32 secret. Random test data needs a password or token generator, not a UUID copied from a log.
- PKCE generator for public OAuth clients.
- TOTP for RFC 6238 code checks.
- Password generator and random string for secrets and disposable test values.
When it looks financial, validate format but do not overclaim
Card, IBAN, ABA routing, ISBN, and Luhn checks are arithmetic and format checks. They are useful for catching typos. They do not prove an account exists, a bank is active, or a card can be charged.
Use Payment card checker, IBAN validate, ABA routing number, and Luhn check as local typo guards, not as registry lookups.
A short routine before you share
- Name the object. Token, certificate, digest, file, identifier, or secret.
- Pick the matching check. Decode, hash, inspect, validate, or generate.
- Redact before screenshots. Local processing does not hide your screen or clipboard.
- Treat results as triage. Your app, bank, IdP, or deployment pipeline is still the final authority.