Security tooling comes with a rule that most other categories do not have: the tool must never become the leak. Anything that accepts a token, a key or a payload has to be understood before it is trusted with real material.

The DevToolBox utilities below are deliberately built to run entirely in your browser — no upload, no server-side processing, no account. You can verify that in your browser's network tab while you use them. They cover the routine inspection work: reading a token, checking a signature, computing a hash, and encoding a value safely before it reaches a page.

🧰 Free DevToolBox Tools

Client-side and free — nothing you paste leaves your browser:

JWT Debugger — Decode and verify JWT signatures locally: HS256/384/512 and RS/ES256-512.
JWT Decoder — Quick decode of a JWT header and payload when verification is not needed.
Hash Generator — MD5, SHA-1, SHA-256, SHA-512, CRC32 and HMAC digests.
Base64 Encoder/Decoder — Encode and decode binary-safe values, including URL-safe Base64.
Base64 Decoder — Decode Base64 back to readable text or binary.
HTML Entity Encoder — Escape user input before it reaches the page.
URL Encoder/Decoder — Percent-encode values for safe transport in URLs.
CIDR / Subnet Calculator — Work out the address range a firewall rule really covers.
Diff Checker — Compare a config before and after a hardening pass.

❓ Frequently Asked Questions

Is it safe to paste a real token into an online decoder?

Not into just any online decoder — many send the value to a server. DevToolBox's JWT tools are client-side JavaScript: the token is parsed in your browser and never uploaded. Even so, treat a live production token as sensitive and revoke it if you are unsure.

What does verifying a JWT actually check?

A JWT has three parts: header, payload and signature. Decoding reads the first two, which anyone can do and which proves nothing. Verification recomputes the signature with the secret or public key and compares, and that is what proves the token was not forged.

Is hashing the same thing as encryption?

No. Encryption is reversible with a key; hashing is one-way. A hash verifies integrity or stores a password-derived value. It cannot be turned back into the original input.

Should I encode or escape user input?

Both, at different layers. Percent-encode values that go into a URL; HTML-entity-encode values that go into a page. The rule is to encode for the context the value is entering, at the moment it enters it.