These tools handle the short strings that prove who someone is or that data hasn’t been changed: a JSON Web Token from an Authorization header, a checksum, a webhook signature, a password, an ID, a Content-Security-Policy header.
The JWT decoder reads a token’s header and claims and checks its expiry against your clock, and the encoder signs one with HS256, HS384 or HS512. The hash generator gives the MD5, SHA-1 and SHA-2 digests of text or raw bytes at once, and when you paste a hash it tells you which of them produced it. The HMAC generator signs a message with a secret key, the way Stripe, GitHub and other webhook senders do, and checks a signature against it. The password, random-string and UUID generators draw from your browser’s cryptographic randomness, and the CSP builder rates a policy directive by directive.
Three mistakes cause most of the trouble. Decoding a JWT isn’t verifying it: anyone can make a token that decodes to any claims, and only a signature check with the right key and an expected algorithm proves anything. MD5 and SHA-1 are broken for security, and no fast hash is right for storing passwords; that’s what bcrypt and Argon2 are for. And an HMAC covers exact bytes, so a re-serialized JSON body or a changed line ending gives a different signature.
Nothing you paste here leaves the page, which matters more in this topic than anywhere else: a live token or a signing secret is as good as a password.