Developers regularly need hashing, signing, encryption and token inspection. The 5 most important rules:
Security operations — hashing a payload, signing an API request, encrypting sensitive data, decoding a JWT — are part of daily developer work. Having fast, reliable browser-based tools for these operations means you can inspect and verify security artifacts without setting up local environments or uploading sensitive data to unknown servers.
A hash function takes an input of any size and produces a fixed-size output (the digest). The same input always produces the same output; even a single character change produces a completely different digest.
MD5 produces a 128-bit (32 hex character) digest. It is fast but cryptographically broken. Use MD5 only for checksums where collision resistance is not required, such as detecting accidental file corruption or cache invalidation keys.
SHA-1 produces a 160-bit digest. Also considered broken since 2017 (the SHAttered attack). Avoid SHA-1 for new security-critical code.
SHA-256 (part of the SHA-2 family) produces a 256-bit digest and is the current standard for security-critical hashing. Used in TLS certificates, code signing, and most modern authentication systems.
SHA-512 produces a 512-bit digest. On 64-bit processors, SHA-512 is often faster than SHA-256 due to its internal word size matching the processor's native width.
HMAC (Hash-based Message Authentication Code) adds a secret key to a hash, producing a signature that proves both the content and the sender's identity.
AWS Signature v4 uses HMAC-SHA256 to sign every API request. The signature covers the HTTP method, URL, headers, and body hash, preventing any tampering in transit.
Stripe and GitHub webhooks include an X-Stripe-Signature or X-Hub-Signature-256 header containing an HMAC-SHA256 of the request body. Your server recomputes this with your webhook secret and rejects requests where the signatures don't match.
JWT HS256 uses HMAC-SHA256 to sign the token header and payload. Use our HMAC Generator to compute and verify HMAC signatures during development and debugging.
AES (symmetric) uses the same key to encrypt and decrypt. It is extremely fast — modern CPUs have hardware instructions for AES achieving multi-gigabyte throughput. AES-256 is used for encrypting data at rest: database fields, file encryption, disk encryption.
RSA (asymmetric) uses a public key to encrypt and the corresponding private key to decrypt. RSA is much slower than AES (1000x or more for bulk data), so it is typically used only to encrypt a small AES key, which then encrypts the actual data (hybrid encryption, as used in TLS).
Padding matters: Never use raw RSA without padding. RSA-OAEP (Optimal Asymmetric Encryption Padding) is the secure standard. Our RSA Encrypt & Decrypt tool uses RSA-OAEP exclusively.
A JWT (JSON Web Token) consists of three Base64url-encoded parts separated by dots: header, payload, and signature.
Header: Specifies the algorithm. {"alg": "HS256", "typ": "JWT"} means HMAC-SHA256 signing. RS256 means RSA-SHA256.
Payload: Contains claims — standard claims include sub (user ID), iss (issuer), exp (expiration Unix timestamp), and iat (issued at).
The none algorithm vulnerability: Some JWT libraries accept {"alg": "none"}, bypassing signature verification entirely. Always verify the algorithm on your server and reject tokens with unexpected algorithms.
JWTs are not encrypted by default: A standard JWT is signed but not encrypted — anyone who intercepts it can read the payload. Never put sensitive data in a JWT payload unless you use JWE.
いいえ。SHA-256 は高速な汎用ハッシュのため、パスワードを総当たりしやすくなります。代わりに bcrypt、scrypt、Argon2 を使ってください。これらは意図的に遅く、メモリを多く消費するよう設計されています。パスワードジェネレーターは強力なパスワードを生成しますが、保存はサーバー側で bcrypt/Argon2 を使うべきです。
エンコード（Base64 など）は互換性のためにデータを変換するもので、鍵なしで元に戻せます。暗号化（AES など）は機密性を守るもので、正しい鍵がなければ元に戻せません。Base64 をセキュリティ対策として使ってはいけません。
JWT デコーダーを使ってください。トークンを貼り付けると、ツールが exp クレームを読み取り、期限切れ／有効を示すわかりやすいインジケーターとともに有効期限を表示します。
はい、crypto.getRandomValues() を使う場合は安全です。パスワードジェネレーターはこれを使っています。これはブラウザーの CSPRNG で、オペレーティングシステムが鍵生成に使うのと同じエントロピー源です。
新規のアプリケーションにはすべて AES-256 を使いましょう。AES-128 も既知の攻撃に対しては技術的に安全ですが、AES-256 はより大きな安全マージンを提供します。最新のハードウェアではパフォーマンスの差はごくわずかです。