Security & Tokens

Inspecting tokens, auditing HTTP security headers, scrubbing photo metadata, hashing data, decoding certificates, and generating IDs. Worth being precise on what these tools actually do: the JWT decoder reads the claims out of a standard JWT, which is signed and Base64URL-encoded but not encrypted, so anyone can decode it without a key. The JWT signer creates and verifies HMAC signatures (HS256/384/512) via the Web Crypto API. The CSP generator audits Content-Security-Policy directives for XSS bypasses. The EXIF viewer and remover strips GPS and camera metadata locally in browser memory. The hash generator produces one-way MD5/SHA digests and HMACs; hashing is not reversible encryption. The Base64 converter is encoding, not encryption, and is reversible by anyone without a key. The certificate decoder parses X.509 certs and CSRs, and the UUID generator produces random identifiers (UUID v4/v7, NanoID, CUID).