Security Tools

Hash, sign, encrypt and inspect the building blocks of application security

Security work is full of small cryptographic tasks: computing a SHA-256 checksum to confirm a download, decoding a JWT to see its claims, generating an RSA key pair, or creating a bcrypt hash for a test user. These tools run the operations on text or files you provide and show the exact output.

The category covers hashing (MD5, SHA, Whirlpool, CRC32), password hashing (bcrypt, PBKDF2), message authentication (HMAC), symmetric and asymmetric encryption, one-time passwords, and JSON Web Tokens. It also generates deployment files such as a Content Security Policy header, a security.txt file and an htpasswd entry.

Developers, system administrators and students use it while building or auditing systems. A word of caution applies: for anything protecting real data, prefer well-reviewed libraries in your own code, and treat these pages as a way to check results and learn how the primitives behave. Never paste a live production secret into any web page, and generate fresh keys for real deployments.

Common questions

Is MD5 still safe to use?

MD5 is fine for spotting accidental file corruption but not for security, because attackers can craft collisions. Use SHA-256 or stronger for integrity checks, and use bcrypt or PBKDF2 for storing passwords.

What is the difference between hashing and encryption?

A hash is a one-way fingerprint that cannot be reversed to recover the input, while encryption is reversible by anyone who holds the key. Hash to verify data, and encrypt when you need to read it back later.

Does decoding a JWT prove it is valid?

No. A JWT's payload is only Base64-encoded, so anyone can read it. Validity depends on the signature, which the verifier tool checks against the secret or public key that the issuer used.