Developers regularly need hashing, signing, encryption and token inspection. The 5 most important rules:
Security operations — hashing a payload, signing an API request, encrypting sensitive data, decoding a JWT — are part of daily developer work. Having fast, reliable browser-based tools for these operations means you can inspect and verify security artifacts without setting up local environments or uploading sensitive data to unknown servers.
A hash function takes an input of any size and produces a fixed-size output (the digest). The same input always produces the same output; even a single character change produces a completely different digest.
MD5 produces a 128-bit (32 hex character) digest. It is fast but cryptographically broken. Use MD5 only for checksums where collision resistance is not required, such as detecting accidental file corruption or cache invalidation keys.
SHA-1 produces a 160-bit digest. Also considered broken since 2017 (the SHAttered attack). Avoid SHA-1 for new security-critical code.
SHA-256 (part of the SHA-2 family) produces a 256-bit digest and is the current standard for security-critical hashing. Used in TLS certificates, code signing, and most modern authentication systems.
SHA-512 produces a 512-bit digest. On 64-bit processors, SHA-512 is often faster than SHA-256 due to its internal word size matching the processor's native width.
HMAC (Hash-based Message Authentication Code) adds a secret key to a hash, producing a signature that proves both the content and the sender's identity.
AWS Signature v4 uses HMAC-SHA256 to sign every API request. The signature covers the HTTP method, URL, headers, and body hash, preventing any tampering in transit.
Stripe and GitHub webhooks include an X-Stripe-Signature or X-Hub-Signature-256 header containing an HMAC-SHA256 of the request body. Your server recomputes this with your webhook secret and rejects requests where the signatures don't match.
JWT HS256 uses HMAC-SHA256 to sign the token header and payload. Use our HMAC Generator to compute and verify HMAC signatures during development and debugging.
AES (symmetric) uses the same key to encrypt and decrypt. It is extremely fast — modern CPUs have hardware instructions for AES achieving multi-gigabyte throughput. AES-256 is used for encrypting data at rest: database fields, file encryption, disk encryption.
RSA (asymmetric) uses a public key to encrypt and the corresponding private key to decrypt. RSA is much slower than AES (1000x or more for bulk data), so it is typically used only to encrypt a small AES key, which then encrypts the actual data (hybrid encryption, as used in TLS).
Padding matters: Never use raw RSA without padding. RSA-OAEP (Optimal Asymmetric Encryption Padding) is the secure standard. Our RSA Encrypt & Decrypt tool uses RSA-OAEP exclusively.
A JWT (JSON Web Token) consists of three Base64url-encoded parts separated by dots: header, payload, and signature.
Header: Specifies the algorithm. {"alg": "HS256", "typ": "JWT"} means HMAC-SHA256 signing. RS256 means RSA-SHA256.
Payload: Contains claims — standard claims include sub (user ID), iss (issuer), exp (expiration Unix timestamp), and iat (issued at).
The none algorithm vulnerability: Some JWT libraries accept {"alg": "none"}, bypassing signature verification entirely. Always verify the algorithm on your server and reject tokens with unexpected algorithms.
JWTs are not encrypted by default: A standard JWT is signed but not encrypted — anyone who intercepts it can read the payload. Never put sensitive data in a JWT payload unless you use JWE.
안 됩니다. SHA-256은 빠른 범용 해시이기 때문에 비밀번호를 무차별 대입으로 쉽게 뚫을 수 있습니다. 대신 bcrypt, scrypt 또는 Argon2를 사용하세요 — 이들은 느리고 메모리를 많이 사용하도록 설계되었습니다. Password Generator는 강력한 비밀번호를 생성하며, 저장은 서버에서 bcrypt/Argon2를 사용해야 합니다.
인코딩(Base64 등)은 호환성을 위해 데이터를 변환하며 — 키 없이도 되돌릴 수 있습니다. 암호화(AES 등)는 기밀성을 보호하며 — 올바른 키가 있어야만 되돌릴 수 있습니다. Base64를 보안 수단으로 절대 사용하지 마세요.
JWT Decoder를 사용하세요. 토큰을 붙여넣으면 도구가 exp 클레임을 읽어 만료일과 함께 명확한 만료/유효 표시를 보여줍니다.
네, crypto.getRandomValues()를 사용할 때는 안전하며, Password Generator가 바로 이것을 사용합니다. 이는 브라우저의 CSPRNG로, 운영체제가 키 생성에 사용하는 것과 동일한 엔트로피 소스입니다.
모든 새 애플리케이션에는 AES-256을 사용하세요. AES-128도 알려진 공격에 대해 기술적으로 안전하지만, AES-256은 더 큰 여유를 제공합니다. 최신 하드웨어에서는 성능 차이가 무시할 수준입니다.