Developers regularly need hashing, signing, encryption and token inspection. The 5 most important rules:
Security operations — hashing a payload, signing an API request, encrypting sensitive data, decoding a JWT — are part of daily developer work. Having fast, reliable browser-based tools for these operations means you can inspect and verify security artifacts without setting up local environments or uploading sensitive data to unknown servers.
A hash function takes an input of any size and produces a fixed-size output (the digest). The same input always produces the same output; even a single character change produces a completely different digest.
MD5 produces a 128-bit (32 hex character) digest. It is fast but cryptographically broken. Use MD5 only for checksums where collision resistance is not required, such as detecting accidental file corruption or cache invalidation keys.
SHA-1 produces a 160-bit digest. Also considered broken since 2017 (the SHAttered attack). Avoid SHA-1 for new security-critical code.
SHA-256 (part of the SHA-2 family) produces a 256-bit digest and is the current standard for security-critical hashing. Used in TLS certificates, code signing, and most modern authentication systems.
SHA-512 produces a 512-bit digest. On 64-bit processors, SHA-512 is often faster than SHA-256 due to its internal word size matching the processor's native width.
HMAC (Hash-based Message Authentication Code) adds a secret key to a hash, producing a signature that proves both the content and the sender's identity.
AWS Signature v4 uses HMAC-SHA256 to sign every API request. The signature covers the HTTP method, URL, headers, and body hash, preventing any tampering in transit.
Stripe and GitHub webhooks include an X-Stripe-Signature or X-Hub-Signature-256 header containing an HMAC-SHA256 of the request body. Your server recomputes this with your webhook secret and rejects requests where the signatures don't match.
JWT HS256 uses HMAC-SHA256 to sign the token header and payload. Use our HMAC Generator to compute and verify HMAC signatures during development and debugging.
AES (symmetric) uses the same key to encrypt and decrypt. It is extremely fast — modern CPUs have hardware instructions for AES achieving multi-gigabyte throughput. AES-256 is used for encrypting data at rest: database fields, file encryption, disk encryption.
RSA (asymmetric) uses a public key to encrypt and the corresponding private key to decrypt. RSA is much slower than AES (1000x or more for bulk data), so it is typically used only to encrypt a small AES key, which then encrypts the actual data (hybrid encryption, as used in TLS).
Padding matters: Never use raw RSA without padding. RSA-OAEP (Optimal Asymmetric Encryption Padding) is the secure standard. Our RSA Encrypt & Decrypt tool uses RSA-OAEP exclusively.
A JWT (JSON Web Token) consists of three Base64url-encoded parts separated by dots: header, payload, and signature.
Header: Specifies the algorithm. {"alg": "HS256", "typ": "JWT"} means HMAC-SHA256 signing. RS256 means RSA-SHA256.
Payload: Contains claims — standard claims include sub (user ID), iss (issuer), exp (expiration Unix timestamp), and iat (issued at).
The none algorithm vulnerability: Some JWT libraries accept {"alg": "none"}, bypassing signature verification entirely. Always verify the algorithm on your server and reject tokens with unexpected algorithms.
JWTs are not encrypted by default: A standard JWT is signed but not encrypted — anyone who intercepts it can read the payload. Never put sensitive data in a JWT payload unless you use JWE.
Nein. SHA-256 ist ein schneller Allzweck-Hash, was das Brute-Forcing von Passwörtern erleichtert. Verwenden Sie stattdessen bcrypt, scrypt oder Argon2 — diese sind bewusst langsam und speicherintensiv ausgelegt. Unser Passwort-Generator erstellt starke Passwörter; die Speicherung sollte auf Ihrem Server bcrypt/Argon2 verwenden.
Kodierung (wie Base64) wandelt Daten aus Kompatibilitätsgründen um — sie ist ohne Schlüssel umkehrbar. Verschlüsselung (wie AES) schützt die Vertraulichkeit — sie ist nur mit dem richtigen Schlüssel umkehrbar. Verwenden Sie Base64 niemals als Sicherheitsmaßnahme.
Verwenden Sie unseren JWT-Decoder. Fügen Sie den Token ein, und das Tool liest den exp-Claim aus und zeigt das Ablaufdatum mit einer eindeutigen Anzeige für abgelaufen/gültig an.
Ja, wenn crypto.getRandomValues() verwendet wird, was unser Passwort-Generator nutzt. Dies ist der CSPRNG des Browsers, dieselbe Entropiequelle, die das Betriebssystem für die Schlüsselerzeugung verwendet.
AES-256 für alle neuen Anwendungen. AES-128 ist technisch sicher gegen bekannte Angriffe, aber AES-256 bietet einen größeren Sicherheitsspielraum. Der Leistungsunterschied ist auf moderner Hardware vernachlässigbar.