Security tools

Client

This page is an index for deterministic security helpers: hashing, signing, token inspection, checksums, password and token generation, certificate inspection, compression, and identifier validation. Open a card for the dedicated route. Most tools stay client-side unless a tool page says otherwise.

If you are choosing between tokens, hashes, PEM blocks, checksums, and identifier checks, read Security checks before you share.

How this hub is organized

Each card opens a dedicated route—encryption and digests, JWT inspection, PKCE, TOTP, checksums, passwords, and validators. Check the execution badge on a card before you paste production secrets.

Browse security utilities

Cards follow the home catalog order for this category: start with crypto, JWT, PKCE, TOTP, SRI, bcrypt, file checksums, payment and bank number checks, PEM inspection, generators, compression, or validators.

Nearby workflows on Toolcore

Common use cases

  • Open JWT decode when you need header and payload JSON from a signed token—remember verification is not performed here.
  • Use HMAC or crypto when reproducing webhook signatures or comparing hash outputs from docs.
  • Use file checksum when verifying a download against a published SHA-256 or MD5 without uploading the file.
  • Use CRC-32 when you need IEEE or Castagnoli CRC32C on pasted UTF-8 or hex bytes—distinct from cryptographic hashes and from whole-file checksum in the file tool.
  • Use IBAN validate when you need MOD-97-10 and length checks locally—no bank directory lookup.
  • Use ABA routing checker when you need the MICR checksum on a nine-digit Fed routing number—still verify institution-specific routines with your bank.
  • Use payment card checker when you need mod 10 plus a Visa/Mastercard/Amex/Discover-style prefix hint from public BIN ranges—still only digits-in-browser.
  • Use ISBN validate when you need ISBN-10 / ISBN-13 checksums or 978↔ISBN-10 conversion without a publisher API—identifiers only.
  • Use OAuth PKCE when you need a fresh code_verifier and S256 code_challenge pair for a public client flow.
  • Use TOTP when you need RFC 6238 codes from a Base32 secret—compare against your IdP or build otpauth URIs without uploading secrets.
  • Use SRI when you need sha256/sha384/sha512 integrity tokens for script or link tags from the exact bytes you will serve.
  • Use bcrypt when you need slow password digests or to verify a candidate password against an existing $2a/$2b hash locally.
  • Jump to Validate tools for Web3 address checks and similar format guards, then return here for other security utilities.

Common mistakes to avoid

  • Pasting live secrets into shared machines

    Processing is local on Toolcore, but screen visibility and clipboard history still matter—prefer redacted samples.

  • Assuming JWT decode implies trust

    Decoding only shows claims; signature and audience checks belong in your application code.

FAQ

Where are format validators?

The validators hub is at /tools/validate (Web3 and more). It is listed below with the other security tools.

Is data sent to a server?

These tools run in your browser unless a specific page documents otherwise.