2 free tools
Security tools
Security tools are the last place you want a server involved. These run entirely in your browser using crypto.getRandomValues and the Web Crypto API, the same primitives browsers use for TLS and encryption keys. Nothing you generate or paste is transmitted, logged, or stored.
All security tools
JWT Decoder
JWT decoder that shows the header, payload, and exp/iat times in plain dates. Runs 100% in your browser, so your token is never uploaded or logged.
Password Generator
Password generator that creates strong random passwords in your browser. Pick length and character types, see entropy, and copy in one click.
About these tools
Create long random passwords with the character sets a site requires, and decode JSON Web Tokens to inspect their header, claims, and expiry without sending the token to a third-party site. A 16-character random password drawn from about 70 characters carries roughly 98 bits of entropy, far beyond any realistic brute-force attack.
Most account takeovers come from reused and phished passwords rather than brute force. Pair a unique generated password for every site with a password manager and two-factor authentication, ideally an authenticator app or passkey instead of SMS. Decoding a JWT does not verify its signature, so never trust claims you have not validated server-side.