Developer Tools & Resources

Which tool for which problem

Reach for the JWT Decoder when a token is being rejected and you need to see why. Decoding shows you the claims — issuer, audience, and crucially the exp timestamp, which is behind a large share of "it worked yesterday" authentication failures. Decoding is not verification: reading a token tells you what it claims, not whether the signature is valid, so never make a trust decision based on a decoded payload alone.

The Hash Generator is for integrity checks and fingerprinting — confirming a downloaded file matches its published checksum, or generating a stable identifier for a piece of content. One thing worth being explicit about: MD5 and SHA-1 are included because you will still encounter them in existing systems, but neither is safe against a deliberate collision, so they should not be used for anything security-critical. And no general-purpose hash, SHA-256 included, is an appropriate way to store passwords — that needs a deliberately slow algorithm like bcrypt or Argon2.

Base64 encoding is not encryption, which is the single most common misunderstanding about it. It is a way to represent binary data in text so it survives transport through systems that expect plain text — embedding an image in CSS, attaching a file to an email, or putting a small payload in a URL. Anyone can decode it instantly.

The UUID Generator and Password Generator both produce random values but for opposite reasons. A UUID needs to be unique, not unguessable — v4 is the default because collisions are effectively impossible at any realistic scale. A generated password needs to be unguessable, and length matters far more than symbol variety: a longer passphrase beats a short string of punctuation almost every time.

The Regex Tester and URL Toolkit round out the set for a different kind of debugging — patterns and addresses rather than tokens or hashes. A regex that looks correct on paper can still fail on the one input you didn't test against, because greedy quantifiers and anchor placement behave in ways that are easy to get backwards without seeing it matched live; testing against real sample strings catches this before it reaches production, not after. URL Toolkit is for the parsing side of the same kind of problem — pulling a query string apart to see exactly which parameter is malformed, or building a UTM-tagged link without hand-editing an ampersand-separated string and hoping nothing broke.

A note on doing this work in the browser

These tasks are routinely done by pasting into whatever site ranks first, which is a genuine problem when the thing being pasted is a production JWT, an API response containing customer records, or a password. A token pasted into a server-side decoder has been transmitted to a third party, and you have no way to know what happens to it next — whether it is logged, retained, or read.

Every tool in this collection runs as JavaScript in your own browser tab. There is no upload step and no server processing, which means these are safe to use with real production values rather than sanitised examples. Once the page has loaded you can disconnect from the internet entirely and they keep working.