Generate passwords, tokens and identifiers from a cryptographically strong source, and inspect the tokens your application already issues. Nothing you paste leaves the browser.
Browse Security & Privacy
- Cipher and Communication ToolsClassical ciphers (ROT13, Caesar, Atbash, Vigenère), Morse code, the NATO phonetic alphabet and MIME email encodings.12 tools
Good places to start
- Secure Password GeneratorGenerate strong passwords in your browser using its cryptographic random source.
- UUID GeneratorGenerate UUIDs in version 4 (random) or version 7 (time-ordered), plus the nil and max special cases.
- JWT DecoderDecode a JSON Web Token to inspect its header and payload, with registered claims explained and timestamps converted to dates.
- Secure Token GeneratorGenerate API keys, session tokens and other secrets with a stated entropy budget in bytes.
All Security & Privacy tools
- JWT DecoderDecode a JSON Web Token to inspect its header and payload, with registered claims explained and timestamps converted to dates.
- JWT Structure ValidatorCheck a JWT for structural problems – section count, Base64URL validity, JSON shape, the required alg field, claim types, expiry and the dangerous alg none case.
- JWT EncoderBuild and sign a demonstration JWT locally with HS256, HS384 or HS512.
Frequently asked questions
Where do the random values come from?
From crypto.getRandomValues, the browser's cryptographically strong random number generator, which is seeded by the operating system. It is not called "true randomness" anywhere here, because a CSPRNG is not a physical entropy source, but it is the right source for a password or a token.
Is it safe to generate a password in a web page?
It is safe in the sense that matters: the password is produced on your own device by the browser's own generator and is never transmitted, logged or stored by this site. What you then do with it matters more. Put it straight into a password manager rather than into a document or an email.
Are the passwords or tokens I generate recorded anywhere?
No. Nothing you generate or paste is sent to a server, saved to this site or written into a shareable link. Analytics on these pages record that a tool was used and its name, never its input or its output.
Is ROT13, Caesar or Atbash actually secure?
No, and none of them is offered as security. They are classical substitution ciphers with no key space worth the name, breakable by hand in minutes. They are here for puzzles, teaching and obscuring a spoiler, not for protecting anything.
What actually makes a password strong?
Length first, then unpredictability. A long passphrase from a random source beats a short string with substituted characters, because attackers model the substitutions. Reuse is the bigger risk in practice: a unique password per account limits one breach to one account.
Does decoding a JWT tell me whether it is valid?
No, and this is a common and dangerous confusion. Decoding shows you the header and payload, which are only Base64URL-encoded and readable by anyone holding the token. Verifying a JWT means checking its signature against the issuer's key, which is a server-side job.
Are UUIDs guaranteed to be unique?
A version 4 UUID is 122 random bits, so a collision is not impossible but is vanishingly unlikely at any realistic scale. It is not a secret: UUIDs are identifiers, not credentials, and should never be used as a password, an access token or a capability URL.
