Security & CryptographySecurity & Cryptography Utilities
Decode JWT tokens, inspect X.509 SSL certificates, generate SSH key pairs with Randomart, compute HMAC/SHA hashes, and verify Bcrypt passwords completely offline in your browser.
Category Tools (7)
Click any tool to launchJWT Decoder & Inspector
Decode JSON Web Tokens securely. Inspect claims, header, and signature status locally.
Base64 / Hex / Binary Multi-Inspector & Image Previewer
Auto-detects and converts between Base64, URL-Safe Base64, Hexadecimal streams, Canonical Hex Dumps, Binary octets, and Data URL images.
Hash Generator (MD5, SHA256, SHA512)
Computes MD5, SHA-1, SHA-256, and SHA-512 in parallel client-side in your browser.
HMAC Generator
Compute Hash-based Message Authentication Codes (HMAC) using SHA256, SHA512, etc.
Bcrypt / Argon2 / PBKDF2 Password Hash Verifier & Generator
Generate and verify passwords against Bcrypt ($2a/$2b), Argon2id, and PBKDF2 hashes with cost factor controls.
X.509 Certificate & CSR Decoder
Decode X.509 PEM certificates and PKCS#10 CSRs in your browser. Inspect Subject, Issuer, SANs, Validity countdown, and fingerprints.
SSH Keypair Generator & Randomart Visualizer
Generate cryptographically secure Ed25519, RSA (2048/4096), and ECDSA SSH key pairs directly in your browser with OpenSSH Randomart.
AI Skill Studio Cross-Domain SpotlightRecommended AI Agent Presets for Security & Cryptography
Amplify your engineering workflows by pairing these offline developer tools with production-ready agent rulebooks and skill definitions.
Security Guard Claude Skill
Equip Claude Code with OWASP vulnerability scanning, secret leak detection, and cryptographic audit skills.
Supabase & Postgres Cursor Rules
Enforce strict Row-Level Security (RLS) policies, prevent service_role leaks, and guard client endpoints.
Docker & DevOps AGENTS.md
Enforce secret management, isolated container networks, and air-gapped SSH deployment rules.
How Security & Cryptography Operates Offline in Browser Memory
Handling credentials, private keys, authentication tokens, and cryptographic certificates on unverified online web tools is a severe security risk. DevScratchpad provides an air-gapped, zero-server-transmission security workstation where all cryptographic operations execute locally in browser memory using WebCrypto and native assembly.
Runtime Security & Isolation
Cryptographic primitives leverage the browser's hardware-accelerated Web Cryptography API (window.crypto.subtle) for SHA-256, SHA-512, HMAC, ECDSA, and RSA keypair generation. Ed25519 and Bcrypt operations utilize pure JavaScript/Wasm implementations with zero remote dependencies. X.509 certificates are parsed using @peculiar/x509 to decode ASN.1 structures locally. Memory buffers are immediately reclaimed upon session refresh, guaranteeing private keys and passwords never traverse the network.
Recommended Usage Workflows
- 01.Inspect JWT headers, payloads, claims, and expiry dates without exposing sensitive bearer tokens to third-party loggers.
- 02.Generate cryptographically secure Ed25519 and RSA SSH key pairs directly in your browser with OpenSSH Randomart visualizer.
- 03.Verify candidate passwords against Bcrypt ($2a/$2b) hashes and calculate secure cost rounds.
- 04.Inspect X.509 SSL/TLS certificates to verify Common Name, Issuer, Subject Alternative Names (SANs), and expiration countdowns.
Key Engineering Advantages
Frequently Asked Questions (Security & Cryptography)
Is it truly safe to paste production JWTs or private keys into this tool?
Yes. Unlike other online tools that send tokens to backend servers for decoding, DevScratchpad performs 100% of cryptographic decoding in client-side memory. You can verify this by checking your browser's Network tab—zero HTTP requests are made.
Which SSH key algorithms can I generate?
You can generate Ed25519 (modern, fast, and secure), RSA (2048 and 4096-bit), and ECDSA (NIST P-256/P-384/P-521) keys with downloadable public and private key files.
How does Bcrypt and Argon2 password verification work offline?
The password hash verifier runs bcryptjs and client-side password hashing routines in your browser, performing salt extraction and cryptographic comparisons locally.
Can I inspect CSRs (Certificate Signing Requests) and SSL certs?
Yes. The X.509 decoder parses PEM certificates and CSRs, extracting SANs, key algorithm specifications, validity periods, and SHA-256 fingerprints.