Security & Tokens Tools — JWKS, Verify, Certificates, Secrets
Six browser-local utilities: inspect JWK/JWKS, verify JWT signatures against pasted JWKS, decode PEM X.509 certificates, scan secrets, hash/verify bcrypt, and convert public PEM ↔ JWK. No remote JWKS fetch, not a trust store. Also useful: jwt-decode, jwt-encode, validate-env, and password-generator.
- Inspect JWKS and verify JWT signatures against pasted keys.
- Decode PEM certificates and convert public PEM ↔ JWK.
- Scan pasted text and hash/verify bcrypt locally.
Inspect JWKS
Inspect JWK/JWKS with private fields redacted — paste-only, no remote fetch.
Decode certificate
Decode PEM X.509 certificates: subject, SANs, expiry, fingerprint — not a trust store.
Scan secrets
Scan pasted text for secret-like patterns — documented subset, not gitleaks.
Bcrypt Hash
Hash or verify passwords with bcrypt (cost 4–14) in the browser — not production auth.
JWT Verify
Live JWT verify — 14 signing algs, JWKS/PEM/HMAC, aud/iss/exp — no URL fetch.
PEM ↔ JWK
Convert public PEM (SPKI) ↔ JWK JSON — private input redacted.
Guides
Optimize REST API Performance with JSON Minification
Speed up your REST APIs by optimizing JSON payloads. Minification, compression, pagination and best practices for ultra-fast APIs.
Online Minifiers vs Build Tools: When to Use Each
Understand the differences between online minifiers and build tools. Learn when to use each approach to optimize your development workflow.