Security tools

Client

This page is an index—open a card for the dedicated route. Cryptography, signing, token inspection, checksums, compression, secrets generation, certificates, and validators stay client-side unless a tool page says otherwise.

Browse security utilities

Cards follow the home catalog order for this category.

Common use cases

  • Open JWT decode when you need header and payload JSON from a signed token—remember verification is not performed here.
  • Use HMAC or crypto when reproducing webhook signatures or comparing hash outputs from docs.
  • Use file checksum when verifying a download against a published SHA-256 or MD5 without uploading the file.
  • Use IBAN validate when you need MOD-97-10 and length checks locally—no bank directory lookup.
  • Use OAuth PKCE when you need a fresh code_verifier and S256 code_challenge pair for a public client flow.
  • Use TOTP when you need RFC 6238 codes from a Base32 secret—compare against your IdP or build otpauth URIs without uploading secrets.
  • Use SRI when you need sha256/sha384/sha512 integrity tokens for script or link tags from the exact bytes you will serve.
  • Use bcrypt when you need slow password digests or to verify a candidate password against an existing $2a/$2b hash locally.
  • Jump to Validate tools for Web3 address checks and similar format guards, then return here for other security utilities.

Common mistakes to avoid

  • Pasting live secrets into shared machines

    Processing is local on Toolcore, but screen visibility and clipboard history still matter—prefer redacted samples.

  • Assuming JWT decode implies trust

    Decoding only shows claims; signature and audience checks belong in your application code.

FAQ

Where are format validators?

The validators hub is at /tools/validate (Web3 and more). It is listed below with the other security tools.

Is data sent to a server?

These tools run in your browser unless a specific page documents otherwise.