JWT decoder and inspector
Paste a three-part JSON Web Token to inspect its decoded header and payload. The tool can show timestamp claims such as exp, iat and nbf in a readable format. It does not verify the cryptographic signature, token issuer, audience or trustworthiness; decoding a token must never be treated as authentication validation.
JWT content can contain sensitive data. Avoid sharing real access tokens in screenshots or public messages, and handle secrets according to your organization's security practices.
HTTP security header analyzer
Paste a set of HTTP response headers to check for the presence of common security controls, including Content-Security-Policy, Strict-Transport-Security, X-Content-Type-Options, Referrer-Policy and clickjacking protection. Results are a presence-based checklist with basic pattern notes, not a full security audit or policy validation.
JSON, Base64 and URL utilities
Format or minify JSON to make machine-readable responses easier to inspect. Transform text using Base64 encoding/decoding or URL encoding/decoding. These are encodings, not encryption, and they do not conceal information from people who have the encoded value.
SHA-256 and SHA-512 digests
Generate SHA-256 and SHA-512 digests using the browser's Web Crypto API on HTTPS. A cryptographic hash helps compare data integrity but is not reversible encryption. Hashing arbitrary passwords without a dedicated password hashing algorithm is not an appropriate password-storage design.
Privacy and safe use
The research utilities process submitted inputs in your browser. They do not submit your entered JWTs, JSON or text to a Secure Hyperloop backend. Vulnerability intelligence requests are separate: those retrieve public information from third-party sources. Only use security techniques and testing data in environments where you have authorization.