Reading, testing, generating, hashing
These five utilities don't share a single theme so much as a category — small, sharp developer and security tools you reach for mid-task rather than plan around. Each is worth understanding individually and knowing where its limits are.
JWT Decoder — reading claims, not verifying them
JWT Decoder decodes a JSON Web Token's header and payload so you can read the claims inside, without verifying the signature — that requires the secret or public key, which the tool doesn't have.
When to use it: debugging why an API call with a JWT is being rejected, checking token expiry (the exp claim) without writing code, or inspecting what claims a third-party service actually puts in its tokens.
Reading results: decoding is not the same as verifying — anyone can decode a JWT and read its contents by design, since the payload isn't encrypted, only signed. Never treat a decoded token as proof of authenticity; that requires checking the signature against the issuer's key, which happens at the application layer, not here.
Regex Tester — matching live
Regex Tester runs a regular expression against sample text and highlights every match live as you type, with capture groups broken out separately.
When to use it: building or debugging a regex before it goes into production code, understanding why a pattern from documentation or Stack Overflow isn't matching what you expect, or testing edge cases like empty strings and special characters before relying on a pattern.
Reading results: pay attention to greedy versus lazy quantifiers when a match is longer than expected — .* consumes as much as possible, while .*? stops at the first valid match. Capture groups are numbered left to right by their opening parenthesis, not by where they appear in the actual match.
Hash Generator — checksums, not password storage
Hash Generator computes cryptographic hashes (MD5, SHA1, SHA256, SHA512 and others) of any text or string.
When to use it: verifying file integrity against a published hash, generating a quick checksum for a configuration string or API payload, or educational purposes — seeing how the same input always produces the same output.
Reading results: MD5 and SHA1 are fine for checksums and non-security comparisons but should never be used for passwords or anything security-sensitive — they're broken for those purposes specifically. Use SHA256 or stronger for integrity checks, and a proper password-hashing function (bcrypt, Argon2) for credentials — never a plain hash, however strong.
Password Generator — random, not memorable
Password Generator generates random passwords using a cryptographically secure random source, with configurable length and character sets.
When to use it: creating strong, unique passwords for new accounts or service credentials, generating API keys or temporary secrets that need to be unpredictable, or replacing weak or reused passwords during a security cleanup.
Reading results: longer generally beats more complex — a 20-character password from a smaller character set is often both stronger and easier to type correctly than a 10-character password crammed with symbols. Use a password manager to store what you generate, and don't reuse generated passwords across services just because each one is individually strong.
Encoding Detector — probabilistic, not certain
Encoding Detector analyzes input text and estimates which character encoding (UTF-8, ISO-8859-1, Windows-1251, etc.) it's likely using.
When to use it: debugging garbled text ("mojibake") in a file or database field, identifying the source encoding before converting legacy data to UTF-8, or diagnosing why text from one system displays incorrectly in another.
Reading results: detection is probabilistic, not certain — short samples are harder to identify confidently than long ones. When in doubt and you control the source, the safer long-term fix is standardizing everything on UTF-8 rather than trying to perfectly detect every legacy encoding forever.
How these fit together
JWT Decoder and Hash Generator both touch security, but at opposite ends — one reads existing tokens, the other creates checksums or (never for passwords) plain hashes. Regex Tester and Encoding Detector are both about understanding text you didn't produce yourself. Password Generator stands alone as the only tool here that creates something new rather than inspecting something that already exists.