Web Security & Cryptography Hub
A comprehensive suite of cryptography and security utilities. Generate strong passwords, RSA keys, Bcrypt hashes, and decode JWTs safely. Zero data is ever sent to our servers.
The non-negotiable rule: never transmit plaintext
Cryptography tools have one job that separates them from every other category on this site: the plaintext you feed them is sensitive. A JWT decoder that silently uploads your token to a server is a security incident, not a tool. Every utility in this hub runs locally, your keys, tokens, and passwords never leave your browser tab.
The tools here map to the cryptographic operations you actually perform in web development. JWT decoding lets you inspect the payload and verify the signature without leaking the token. RSA/ED25519 key generation produces key pairs for SSH, code signing, or JWT verification using the Web Crypto API. Bcrypt/Argon2 hashing lets you pre-compute password hashes for staging databases or verify hashing behavior. AES encryption/decryption handles symmetric encryption for data-at-rest scenarios.
The password tools deserve special attention. Password strength is measured in entropy bits, not character-class rules. The entropy calculator shows you the actual information-theoretic strength of a password, "correct horse battery staple" scores higher than "P@ssw0rd!" despite having "fewer rules." The generator uses crypto.getRandomValues() for cryptographically secure output.
Choosing the right algorithm in 2026: ED25519 for signing (faster than RSA at equivalent security), X25519 for key exchange, AES-256-GCM for symmetric encryption (provides both confidentiality and authenticity in one step), Argon2id for new password hashing projects, bcrypt at cost 12+ as an acceptable fallback. Avoid AES-CBC + manual HMAC, GCM subsumes both.
Featured Tools
All Web Security & Cryptography Hub Tools
Quick Summary
Cryptographic operations need two things you don't get from random online tools: correctness (using audited algorithms) and privacy (never transmitting plaintext). This hub provides client-side primitives, JWT decoding, RSA key generation, bcrypt hashing, AES encryption, password analysis, all running offline in your browser.
Key Takeaways
- Bearer tokens, passwords, and private keys are sensitive credentials, they should never be pasted into a third-party server.
- Modern crypto choices in 2026: ED25519/X25519 (signing/key exchange), AES-256-GCM (symmetric), Argon2id (password hashing), bcrypt cost 12+ (acceptable fallback).
- JWT signatures verify authenticity; the payload itself is just base64-encoded JSON anyone can read.
- Password strength = entropy bits, not character classes, `correct horse battery staple` beats `P@ssw0rd!` despite 'fewer rules'.
- Web Crypto API (`window.crypto.subtle`) powers most of these tools, same primitives the browser itself uses for TLS.
When to use it
- Decoding a production JWT to debug auth without leaking the token to jwt.io's servers.
- Generating RSA or ED25519 key pairs for SSH, code signing, or JWT verification.
- Hashing seed passwords with bcrypt before inserting into a staging database.
- Auditing password policies by checking real-world entropy against NIST recommendations.
Common Mistakes
- Decoding sensitive JWTs on jwt.io, the request is logged. Use a client-side tool.
- Storing bcrypt-hashed passwords with cost factor < 12, too fast to defeat modern brute-force.
- Using AES-CBC + manual HMAC when AES-GCM provides both confidentiality and authenticity in one step.
- Re-using IVs/nonces across encryptions with the same key, catastrophic for GCM mode.
Web Security & Cryptography Hub, Frequently Asked
Is the browser's Web Crypto API actually secure?
Yes, it's the same API used internally for TLS and Subresource Integrity. Implementations are audited; you should trust it more than a hand-rolled JS crypto library.
Why does bcrypt limit passwords to 72 bytes?
Bcrypt's algorithm uses only the first 72 bytes of input. Longer passwords are silently truncated. To bypass this, pre-hash long inputs with SHA-256 before bcrypt, or use Argon2id, which has no such limit.
Can these tools be used for compliance audits?
They're auditable (open source, runs client-side) but not formally certified. For PCI/HIPAA/SOC2 evidence, use them as part of the diagnostic toolkit, not as the system of record.
Tool Comparisons
- RSA Key Pair Generator vs Bcrypt Hash GeneratorRSA is an asymmetric encryption and signing algorithm, two related keys, one public, one private. Bcrypt is a one-way password hash, irreversible by design, deliberately slow to resist brute force. They solve completely different problems and aren't substitutes for each other.
- JWT Decoder vs Base64 EncoderJWTs are three Base64URL strings joined by dots, so a Base64 decoder can technically read the pieces, but a JWT decoder parses the header and payload as JSON, surfaces the expiry, and flags the signature algorithm in one view.
In-Depth Tutorials
- Bcrypt vs. Argon2 in Practice: Choosing the Right Hashing AlgorithmDon't settle for MD5 or SHA-256 for passwords. Learn why Bcrypt and Argon2 are the industry standards, how they differ, and which one you should use for your next project in 2026.
- Docker Compose Secrets: Stop Putting Credentials in docker-compose.yml
- Environment Variables Done Right: .env, Secrets, and Runtime Injection (2026)
- How TOTP 2FA Actually Works (and How to Test It Without Your Phone)
- HTTP Security Headers: The 2026 Complete Checklist
- JSON Security: Defense Against Injection and Key Collisions
- JWT Security 101: How to Audit Tokens Without Leaking Secrets
- JWT Tokens Explained: Decode, Verify & Common Mistakes (2026 Guide)
Developer Workflows
- Secure API Authentication DebuggingA complete workflow to decode, verify, and debug JWT-based authentication flows without sending tokens to any external server.
- Password Security Audit WorkflowEvaluate password strength, generate bcrypt hashes, and calculate entropy for security audits.
- SSL Certificate Inspection & DebuggingDecode PEM certificates, check SSL configuration, and validate security headers in one browser-based workflow.
- Content Security Policy (CSP) BuilderBuild, test, and validate a Content Security Policy from scratch to protect against XSS attacks.
- End-to-End AES Encryption WorkflowEncrypt sensitive data with AES-256-GCM, encode output for transmission, and generate secure random passwords.
Troubleshooting & Errors
- invalid_grant: OAuth 2.0 Invalid GrantThe provided authorization grant or refresh token is invalid, expired, revoked, or does not match the redirection URI.
- TokenExpiredError: JWT TokenExpiredErrorThe JWT has passed its expiration time (exp claim).
- JsonWebTokenError: JWT Invalid SignatureThe JWT signature does not match the expected signature for the given header and payload.
- invalid_client: OAuth 2.0 Invalid ClientThe client authentication failed, the client_id or client_secret is invalid.