Security tools

Client

This page is an index—open a card for the dedicated route. Cryptography, signing, token inspection, checksums, compression, secrets generation, certificates, and validators stay client-side unless a tool page says otherwise.

How this hub is organized

Each card opens a dedicated route—encryption and digests, JWT inspection, PKCE, TOTP, checksums, passwords, and validators. Check the execution badge on a card before you paste production secrets.

Browse security utilities

Cards follow the home catalog order for this category.

Nearby workflows on Toolcore

Common use cases

  • Open JWT decode when you need header and payload JSON from a signed token—remember verification is not performed here.
  • Use HMAC or crypto when reproducing webhook signatures or comparing hash outputs from docs.
  • Use file checksum when verifying a download against a published SHA-256 or MD5 without uploading the file.
  • Use CRC-32 when you need IEEE or Castagnoli CRC32C on pasted UTF-8 or hex bytes—distinct from cryptographic hashes and from whole-file checksum in the file tool.
  • Use IBAN validate when you need MOD-97-10 and length checks locally—no bank directory lookup.
  • Use ABA routing checker when you need the MICR checksum on a nine-digit Fed routing number—still verify institution-specific routines with your bank.
  • Use payment card checker when you need mod 10 plus a Visa/Mastercard/Amex/Discover-style prefix hint from public BIN ranges—still only digits-in-browser.
  • Use ISBN validate when you need ISBN-10 / ISBN-13 checksums or 978↔ISBN-10 conversion without a publisher API—identifiers only.
  • Use OAuth PKCE when you need a fresh code_verifier and S256 code_challenge pair for a public client flow.
  • Use TOTP when you need RFC 6238 codes from a Base32 secret—compare against your IdP or build otpauth URIs without uploading secrets.
  • Use SRI when you need sha256/sha384/sha512 integrity tokens for script or link tags from the exact bytes you will serve.
  • Use bcrypt when you need slow password digests or to verify a candidate password against an existing $2a/$2b hash locally.
  • Jump to Validate tools for Web3 address checks and similar format guards, then return here for other security utilities.

Common mistakes to avoid

  • Pasting live secrets into shared machines

    Processing is local on Toolcore, but screen visibility and clipboard history still matter—prefer redacted samples.

  • Assuming JWT decode implies trust

    Decoding only shows claims; signature and audience checks belong in your application code.

FAQ

Where are format validators?

The validators hub is at /tools/validate (Web3 and more). It is listed below with the other security tools.

Is data sent to a server?

These tools run in your browser unless a specific page documents otherwise.