Security & Cryptography Utilities
Decode JWT tokens, inspect X.509 SSL certificates, generate SSH key pairs with Randomart, compute HMAC/SHA hashes, and verify Bcrypt passwords completely in your browser.
Category Tools (7)
Click any tool to launchJWT Decoder & Inspector
Decode JSON Web Tokens locally. Inspect header and claims, and verify HS256 signatures with your secret.
- #1Paste your base64-encoded JWT into the input field.
- #2The tool automatically splits and decodes the Header and Payload claims.
Base64 / Hex / Binary Multi-Inspector & Image Previewer
Auto-detects Base64, URL-safe Base64, Hex, Binary, URL-encoded, and Data URL input and converts it to every format, plus a Canonical Hex Dump.
- #1Paste any string, Base64 payload, Hex stream, Binary bits, or Data URL image into the editor.
- #2The tool auto-detects the encoding format and renders simultaneous multi-format conversions.
Hash Generator (MD5, SHA256, SHA512)
Computes MD5, SHA-1, SHA-256, and SHA-512 in parallel client-side in your browser.
- #1Type or paste any text into the Input Text box.
- #2The engine calculates all cryptographic hash sums simultaneously.
HMAC Generator
Compute Hash-based Message Authentication Codes (HMAC) using SHA256, SHA512, etc.
- #1Enter your secret key.
- #2Enter the message payload.
Bcrypt / Argon2 / PBKDF2 Password Hash Verifier & Generator
Generate Bcrypt, Argon2id, PBKDF2, and SCrypt hashes (with Bcrypt cost and PBKDF2 iteration controls) and verify passwords against Bcrypt hashes.
- #1Toggle between 'Generate Hash' and 'Verify Password Against Hash' modes.
- #2In Generate mode: enter the plaintext password, adjust the Bcrypt cost factor or PBKDF2 iterations, and click 'Copy Hash'.
X.509 Certificate & CSR Decoder
Decode X.509 PEM certificates and PKCS#10 CSRs in your browser. Inspect Subject and Issuer CN, validity dates, public key info, and fingerprints.
- #1Paste a PEM certificate (-----BEGIN CERTIFICATE-----) or CSR (-----BEGIN CERTIFICATE REQUEST-----), or click 'Upload Certificate' to load a PEM-encoded .pem/.crt/.cer/.csr file.
- #2Instantly inspect the Valid/Expired badge, Not Before/Not After dates, Subject CN, and Issuer CN.
SSH Keypair Generator & Randomart Visualizer
Generate cryptographically secure Ed25519, RSA (2048/4096), and ECDSA P-256 SSH key pairs directly in your browser with OpenSSH Randomart.
- #1Select your desired algorithm (Ed25519 is recommended for modern servers).
- #2Enter a Key Comment / Identity (e.g. user@devscratchpad), then click 'Generate New Keypair'.
How Security & Cryptography Runs in Browser Memory
Handling credentials, private keys, authentication tokens, and cryptographic certificates on unverified online web tools is a severe security risk. DevScratchpad provides an air-gapped, zero-server-transmission security workstation where all cryptographic operations execute locally in browser memory using WebCrypto and native assembly.
Runtime Security & Isolation
Cryptographic primitives leverage the browser's hardware-accelerated Web Cryptography API (window.crypto.subtle) for SHA-256, SHA-512, HMAC, ECDSA, and RSA keypair generation. Ed25519 and Bcrypt operations utilize pure JavaScript/Wasm implementations with zero remote dependencies. X.509 certificates are parsed using @peculiar/x509 to decode ASN.1 structures locally. Memory buffers are immediately reclaimed upon session refresh, guaranteeing private keys and passwords never traverse the network.
Recommended Usage Workflows
- 01.Inspect JWT headers, payloads, claims, and expiry dates without exposing sensitive bearer tokens to third-party loggers.
- 02.Generate cryptographically secure Ed25519 and RSA SSH key pairs directly in your browser with OpenSSH Randomart visualizer.
- 03.Verify candidate passwords against Bcrypt ($2a/$2b) hashes and calculate secure cost rounds.
- 04.Inspect X.509 SSL/TLS certificates to verify Common Name, Issuer, Subject Alternative Names (SANs), and expiration countdowns.
Key Engineering Advantages
- 100% Client-Side WebCrypto execution ensuring zero server transmission of private keys.
- Comprehensive JWT decoding with timestamp conversion and signature claim analysis.
- Instant SSH keypair generation (Ed25519, RSA 4096) with OpenSSH Randomart preview.
- Multi-hash calculations (MD5, SHA-1, SHA-256, SHA-512, HMAC) calculated in parallel.
Frequently Asked Questions (Security & Cryptography)
Is it truly safe to paste production JWTs or private keys into this tool?
Yes. Unlike other online tools that send tokens to backend servers for decoding, DevScratchpad performs 100% of cryptographic decoding in client-side memory. You can verify this by checking your browser's Network tab—zero HTTP requests are made.
Which SSH key algorithms can I generate?
You can generate Ed25519 (modern, fast, and secure), RSA (2048 and 4096-bit), and ECDSA (NIST P-256/P-384/P-521) keys with downloadable public and private key files.
How does Bcrypt and Argon2 password verification work in the browser?
The password hash verifier runs bcryptjs and client-side password hashing routines in your browser, performing salt extraction and cryptographic comparisons locally.
Can I inspect CSRs (Certificate Signing Requests) and SSL certs?
Yes. The X.509 decoder parses PEM certificates and CSRs, extracting SANs, key algorithm specifications, validity periods, and SHA-256 fingerprints.