64 tools · zero uploads
Key material,
made in your browser.
Generate, inspect, sign and audit API keys, JWTs and webhook secrets. Every byte comes from your own machine's CSPRNG and stays there — there is no server to send it to.
- Vendor signatures
- 95
- Providers
- 67
- Input bytes sent
- 0
Most used
The six people reach for first.
- GENGenerators
Random API key generator
Draw 64 to 1024 bits of key material from your browser's CSPRNG, in any encoding.
- JWTTokens
JWT decoder & debugger
Decode header, payload and signature, resolve every timestamp, and verify with a secret or public key.
- HMACSignatures
HMAC signature generator
Compute HMAC-SHA1, SHA-256, SHA-384 and SHA-512 signatures, and verify one you were sent.
- SCANScanners
API key vendor detector
Identify which provider a key belongs to, what it grants, and how to revoke it.
- GENGenerators
UUID, ULID & Nano ID generator
Generate UUID v1, v4 and v7, ULIDs, Nano IDs and Base58 identifiers.
- ENCEncoding
Base64 & Base32 encoder
Convert between text, hex, Base64, Base64URL, Base32, Base58, binary and decimal, with a hex dump.
The full bench
Seven channels, 64 instruments.
Why in-browser matters here
A pasted key is a shared key
The moment a credential is posted to someone else's server it must be treated as compromised — logged, cached, or retained in a backup you cannot see. These tools give that server no chance to exist.
Randomness with provenance
Keys are drawn from crypto.getRandomValues, your operating system's CSPRNG. No server can prove what its generator did; your own machine needs no such proof.
Verify it yourself
Open any tool, turn off your network, and keep working. Watch the network tab while you type and you will see nothing leave. That is a stronger assurance than a privacy policy.