Dev Core
Hash text and files with SHA-256 / SHA-512, decode and verify JWTs, craft glassmorphism CSS, encode Base64 data-URIs, test regular expressions live and generate UUIDs or secure passwords. Nothing you paste ever leaves the page.
HMAC
Verify HMAC signature (HS256 / HS384 / HS512)
Decoding never checks the signature — verify it above with the secret.
Live preview of your settings.
File → Data-URI
JSON formatter / validator
URL encoder / decoder
UUID v4 generator
Secure password generator
Engineering Breakdown
Hashing uses crypto.subtle.digest for SHA-1, SHA-256, SHA-384 and SHA-512 on UTF-8 bytes or a file's raw ArrayBuffer, with a debounced live update and a constant-time-style comparison against a pasted checksum; HMAC signs the same bytes with crypto.subtle.sign and an imported raw key. The JWT inspector splits the token on dots, base64url-decodes header and payload (padding and the -_ alphabet are restored before atob), pretty-prints the JSON, converts iat, nbf and exp claims into local times with a live validity countdown, and can verify HS256/384/512 signatures with crypto.subtle.verify — decoding alone never proves authenticity. The glassmorphism generator composes backdrop-filter: blur() saturate(), a translucent fill and a hairline border into copy-ready CSS with a live preview over a colourful stage. Base64 conversion is UTF-8 safe and chunked so large files do not overflow the call stack. The RegEx tester builds a RegExp from your pattern and flags, iterates matches with a zero-length-match guard, and highlights them with HTML-escaped output. Passwords use crypto.getRandomValues with rejection sampling to avoid modulo bias, and a Fisher–Yates shuffle so required character classes are not predictable.
How to use it in 3 steps
- Choose a tab and paste text, a token or a file — processing starts instantly in your browser.
- Adjust options such as hash algorithm, flags, blur and opacity, or password length and character sets.
- Copy the result or download the decoded file; no data is sent to any server.
Feature matrix
| Tool | API used | Output |
|---|---|---|
| SHA / HMAC | crypto.subtle.digest / sign | Hex digest |
| JWT Inspector | atob + crypto.subtle.verify | JSON, expiry status, HMAC check |
| Glassmorphism | CSS backdrop-filter | Copyable CSS |
| Base64 / Data-URI | btoa, TextEncoder | Text or data: URI |
| RegEx Tester | RegExp | Highlights, groups, replace preview |
| JSON · URL · UUID · Password | JSON, encodeURI, getRandomValues | Text |
Frequently asked questions
How do I generate a SHA-256 hash online without uploading data?
Paste text or choose a file on the SHA / HMAC tab. The hash is computed locally with the browser's crypto.subtle.digest function, so nothing leaves your device.
Does decoding a JWT verify it?
No. Anyone can decode a JWT because header and payload are only base64url-encoded. Use the verify box with your shared secret to check an HMAC signature, and never trust unverified claims.
Is it safe to paste a production token?
The token is processed only in your browser and not transmitted, but you should still avoid pasting live production secrets into any website. Prefer test tokens.
Why do SHA-256 results differ between tools?
Different text encodings, trailing newlines or line-ending conversions change the bytes. This tool hashes the UTF-8 bytes of exactly what is in the box.
Why does Web Crypto sometimes say it is unavailable?
The Web Cryptography API only works on secure origins — HTTPS or localhost. Cloudflare Pages serves over HTTPS, so it works there.