Free Online Security Tools
Security work demands tools you can trust with sensitive input. This collection covers the everyday tasks: generate MD5, SHA-1, SHA-256 or SHA-512 hashes and checksums with the WebCrypto API, decode a JWT to inspect its header and payload, generate a cryptographically strong password in any length and character mix you choose, escape HTML entities to prevent XSS, or apply the classic ROT13 cipher.
Because everything executes client-side in your browser, the tokens, secrets, and text you paste are never transmitted anywhere — a hard requirement when you are debugging production credentials. Each tool is free, instant, and works without an account.
All Security Tools (6)
Hash Generator
Generate MD5, SHA-1, SHA-256 and SHA-512 hashes instantly in your browser. Free client-side checksum calculator — your text never leaves your device.
Launch ToolHTML Entity Encoder
Escape HTML characters online — encode <, >, & and quotes into safe HTML entities to prevent XSS and display code snippets. Free and client-side.
Launch ToolSecure Password Generator
Generate strong, random passwords from 8 to 64 characters with uppercase, lowercase, number, and symbol toggles — cryptographically secure, created in your browser.
Launch ToolJWT Decoder
Decode JWT tokens to view the header and payload instantly — inspect claims without verifying the signature. Free, client-side JWT decoder viewer.
Launch ToolROT13 Encoder/Decoder
Encode or decode ROT13 text instantly — the classic Caesar substitution cipher that is its own inverse. Free, client-side ROT13 cipher translator.
Launch ToolJWT Generator
Build and sign a real JWT from a custom header, payload, and HS256 secret — the missing companion to the JWT Decoder. Free, client-side JWT generator.
Launch ToolFrequently Asked Questions
- Does the password generator let me customize length and characters?
- Yes — choose any length from 8 to 64 characters and toggle uppercase, lowercase, numbers, and symbols independently; a live entropy estimate updates as you adjust.
- Can the JWT decoder verify a token's signature?
- No — it's a viewer, not a validator. It decodes the header and payload, which need no secret key to read; signature verification requires the issuer's key and has to happen server-side.