Security Tools for Developers
These tools help developers and security reviewers inspect the cryptographic and protocol pieces of an application: hashes and checksums, password hashing, JSON Web Tokens, SAML messages, X.509 certificates, JSON Web Keys and digital signatures. They also cover review work, such as grading HTTP security headers, spotting SQL injection patterns in code and building a threat checklist for a design review.
13 free tools · no sign-up · no ads
All Security Tools (13)
Hash Generator
Generate MD5, SHA, and other hashesPassword Generator
Generate secure random passwordsBcrypt Hash Generator
Generate and verify bcrypt password hashesJWT Decoder
Decode and verify JWT tokensSSL Checker
Check certificate expiry, hostname and chain order from a pasted chainSecurity Headers Analyzer
Grade HTTP security headers like CSP and HSTS from pasted headersJWK Tool
JSON Web Key utilitiesX.509 Parser
Parse X.509 certificatesSQL Injection Tester
Test for SQL injection vulnerabilitiesSAML Tool
SAML assertion utilities and validatorHash File Verifier
Verify file integrity using hash checksumsDigital Signature Validator
Validate digital signatures and certificatesSecurity Threat Checklist
Browse 22 common threat classes and export a Markdown checklist
Which tool do I need?
Check that a download matches its SHA-256 checksum
The Hash File Verifier hashes the file locally and accepts a bare digest, a sha256sum line, BSD output or an SRI value as the expected checksum.
Read the claims in a token to debug a 401 response
The JWT Decoder shows the header and payload, including alg, aud and exp, without needing the signing key.
Find out why a certificate is rejected by some clients
Paste openssl s_client output into the SSL Checker for expiry, hostname coverage and chain order, then inspect a single certificate in the X.509 Parser.
Debug a failing SAML single sign-on
Decode the SAMLResponse to check Audience, Destination and time conditions, and read the IdP signing certificate with the X.509 Parser.
Review a change for injection risks and missing headers
Paste the code that builds queries into the SQL Injection Tester, grade response headers from curl, and track the rest in the Security Threat Checklist.
SQL Injection TesterSecurity Headers AnalyzerSecurity Threat Checklist
Create a strong password, or see how password storage should work
Generate a random password with the Password Generator, and use the Bcrypt Hash Generator with dummy values to see salts and cost factors in action.
About Security Tools
The tools group by question. To check integrity, use the Hash Generator for text and the Hash File Verifier to compare a download with its published checksum. To prove who produced something, use the Digital Signature Validator, which performs a real Web Crypto verification with a public key. For passwords, the Password Generator draws from crypto.getRandomValues and the Bcrypt Hash Generator shows how cost factors and salts behave. For login and SSO problems, decode the token with the JWT Decoder or the SAMLResponse with the SAML Tool, read the signing certificate with the X.509 Parser, and convert keys between JWK and PEM with the JWK Tool. The SSL Checker reviews a whole certificate chain from openssl output.
Know what each one does not do. The JWT Decoder and SAML Tool decode but do not verify signatures, the SSL Checker and X.509 Parser read structure but do not check revocation or a trust store, and the SQL Injection Tester matches patterns in text and never touches a live site. The SSL Checker and Security Headers Analyzer ask you to paste openssl or curl output because a browser cannot read another site's certificate or most of its response headers. All processing stays in the tab, but use test values where you can: no web page is the right place for a production private key.
Guides
- MD5, SHA-1, SHA-256 and CRC32: Choosing the Right HashChecksums, fingerprints and integrity checks all use hashes, but not the same ones. Here is what each algorithm is good for and which ones you should retire.
- How JWTs Work: Decoding Headers, Payloads and ClaimsA JSON Web Token is three Base64URL strings and a lot of misunderstanding. Learn what each part holds, which claims matter, and why decoding is not verifying.
- How to Read an X.509 Certificate and Debug a TLS ChainWhat each field in a TLS certificate means, why browsers ignore the Common Name, how chains are built, and how to diagnose expiry, hostname and missing-intermediate errors.
- Bcrypt Explained: Salts, Cost Factors and Storing Passwords SafelyWhy fast hashes are wrong for passwords, what each part of a $2b$ string means, how to pick a cost factor and where bcrypt fits next to Argon2 and scrypt.
Frequently asked questions
What is the difference between hashing, encryption and signing?
Hashing produces a fixed fingerprint of data with no key and cannot be reversed. Encryption hides data so that only a key holder can read it, and is reversible with that key. Signing proves the data was signed by the holder of a particular private key: a private key creates the signature and anyone with the public key can verify it. Base64 is none of these; it is only an encoding.
Is it safe to paste tokens, certificates and keys into browser security tools?
Certificates and public keys are public by design, so pasting them is fine. Tokens and SAML responses are credentials until they expire, and they can contain personal data, so prefer test ones and rotate real ones afterwards. Never paste a production private key into any web page, even one that processes locally.
Why do some security tools decode a token without verifying it?
Verification needs the issuer's secret or public key, while decoding only needs the token. The JWT Decoder and SAML Tool decode, so treat their output as what the token claims rather than what has been proven. The Digital Signature Validator does verify, when you supply the public key.
Can these tools test whether my live website is secure?
No. They inspect material you paste: openssl and curl output, code, tokens and certificates. Nothing in this group sends test traffic to a site. For dynamic testing, use an authorised scanner against systems you own or have written permission to test.
Which hash should I use for passwords and which for file checksums?
For passwords use a slow, salted algorithm such as bcrypt, scrypt or Argon2, never a plain SHA-256. For file checksums SHA-256 is the usual choice. MD5 and SHA-1 still detect accidental corruption but should not be relied on where someone could craft a collision.