Security Tools That Keep Inspection Separate from Trust
Security data is easy to overread. A JWT can be decoded without being authentic, a strong-looking hash may reveal nothing about how a password was stored, and the presence of a response header does not prove the surrounding application is secure. These tools are designed around those distinctions rather than a single pass/fail security score.
Start with the Claim You Need to Establish
“What does this token contain?” Decode JWT structure or claims. That reveals data, not whether the issuer, signature, audience, time window, or application policy should trust it.
“Does this MAC or signature match?” Verification needs the exact algorithm, key material, and signed bytes. A cryptographic match still does not replace issuer or authorization checks.
“Is this secret suitable?” Length, randomness, algorithm requirements, reuse, storage, rotation, and exposure all matter. A local strength check can only inspect the value you provide.
“Is this browser policy configured sensibly?” CSP, HSTS, cookie attributes, referrer policy, and Permissions Policy can be checked for obvious issues, but application security extends far beyond headers.
Representative Security Questions
These selections cover signature verification, cookies, CSP, signing secrets, certificate inspection, and vulnerability-contact metadata.
JWT Signature Verifier
Verify an HS256 JWT signature against exact UTF-8 secret bytes without treating a match as token acceptance.
Open tool →CSP Analyzer
Parse CSP directives and sources, then flag duplicate rules, invalid combinations, and risky allowances.
Open tool →PEM Certificate Viewer
Inspect PEM certificate blocks, decode readable certificate content, and review certificate details in your browser.
Open tool →Cookie Security Checker
Check Set-Cookie attributes, prefix rules, cross-site behavior, and scope without guessing application intent.
Open tool →JWT Secret Strength Checker
Check HS256, HS384, or HS512 key bytes against required minimum lengths and flag obviously guessable secrets.
Open tool →Security.txt Generator
Build RFC 9116 security.txt content with required Contact and Expires fields plus optional Policy, Encryption, and Acknowledgments entries.
Open tool →All Security Tools
Browse all 29 tools for JWTs, hashes, HMACs, bcrypt, random secrets, RSA keys, PEM and certificates, CSP, CORS, cookies, HSTS, Permissions Policy, SRI, Referrer Policy, security.txt, and TLS-expiry planning.
Hash Generator
Produce hexadecimal SHA-1, SHA-256, SHA-384, or SHA-512 digests from exact UTF-8 text.
Password Generator
Pick length and character groups, then generate a cryptographically random credential entirely in the browser.
HMAC Generator
Generate HMAC message authentication codes with a secret key using SHA-256, SHA-384, or SHA-512 for signing and integrity checks.
bcrypt Generator
Generate salted bcrypt password hashes with a selectable cost factor for development, testing, and password-storage workflows.
Random Token Generator
Generate Base64URL, alphanumeric, hex, or numeric secrets for API, webhook, session, and verification workflows.
SHA256 Generator
Hash exact UTF-8 text with SHA-256 and see how small input differences change the digest.
RSA Key Generator
Generate RSA signing key pairs with Web Crypto and export SPKI public and PKCS #8 private PEM.
Base64URL Encoder Decoder
Encode UTF-8 text as unpadded Base64URL or decode Base64URL and three-part JWT payload segments.
PEM Formatter
Normalize PEM Base64 padding and line wrapping while checking boundaries, labels, and multiple blocks.
CSP Generator
Build a Content-Security-Policy header and spot broad sources, malformed keywords, and overly permissive script rules.
JWT Signature Verifier
Verify an HS256 JWT signature against exact UTF-8 secret bytes without treating a match as token acceptance.
CORS Header Checker
Check whether CORS response headers match the requested origin, method, headers, and credentials mode.
Security Headers Scanner
Read pasted security response headers, with an optional browser check when CORS exposes them.
CSP Analyzer
Parse CSP directives and sources, then flag duplicate rules, invalid combinations, and risky allowances.
Security Header Generator
Build a starter security-header bundle across HSTS, CSP, framing, MIME, referrer, permissions, and isolation policies.
PEM Certificate Viewer
Inspect PEM certificate blocks, decode readable certificate content, and review certificate details in your browser.
CSP Policy Builder
Build an enforced or report-only CSP from selected directives and sources, ready for an HTTP header.
Cookie Security Checker
Check Set-Cookie attributes, prefix rules, cross-site behavior, and scope without guessing application intent.
HSTS Header Generator
Build an HSTS header while keeping max-age, subdomain scope, and preload consequences visible.
Permissions Policy Header Generator
Define browser-feature allowlists and exact origin scope in a Permissions-Policy header.
JWT Claims Inspector
Decode JWT structure and inspect timing, issuer, audience, scopes, roles, and claim-policy warnings.
Hash Algorithm Identifier
Separate self-identifying password hashes from ambiguous digest shapes using prefixes, length, and encoding.
CSP Report Analyzer
Group CSP violation reports by directive and disposition, while separating blocked resources from report-only findings.
Subresource Integrity Hash Generator
Hash exact UTF-8 script or stylesheet text for SRI and produce integrity attributes for HTML tags.
Referrer Policy Generator
Build a Referrer-Policy header and compare same-origin, cross-origin, and HTTPS-to-HTTP referrer behavior.
JWT Secret Strength Checker
Check HS256, HS384, or HS512 key bytes against required minimum lengths and flag obviously guessable secrets.
Security.txt Generator
Build RFC 9116 security.txt content with required Contact and Expires fields plus optional Policy, Encryption, and Acknowledgments entries.
TLS Certificate Expiry Reminder Generator
Plan renewal from a known TLS certificate expiry date with reminder dates, checklists, and calendar notes.
Bearer Token Header Generator
Format Bearer Authorization headers and request snippets with optional redaction, without verifying token validity or authorization.
Hashing, HMAC, Password Hashing, and Encryption Are Not Interchangeable
A general cryptographic hash produces a digest from input bytes and does not use a secret key. HMAC combines a cryptographic hash with a shared secret to authenticate a message. Password hashing such as bcrypt is deliberately designed to make password guessing more expensive and uses salts and a work factor. None of those operations is reversible encryption.
The category also contains encoding helpers because security formats use encodings internally, but representation should not be mistaken for protection. Base64URL makes bytes safe for compact text formats; it does not hide them from someone who can read the token.
Handling Secret Material in Browser Tools
Local browser processing reduces the need to send pasted values to a Yoryantra application server, but “local” does not make sensitive data risk-free. Clipboard history, browser extensions, screenshots, crash reports, screen sharing, and the device itself remain possible exposure paths.
Use test keys or disposable examples when the real secret is not required. If production credentials, private keys, signing secrets, or bearer tokens are exposed outside their intended environment, treat rotation and incident handling as operational security decisions rather than formatting problems.
References for the Security Boundaries Used Here
Defines JWT claims and compact token structure; signature and encryption mechanisms are supplied by the JOSE specifications it references.
Provides deployment context for CSP, HSTS, framing, MIME sniffing, referrer, permissions, and cross-origin response policies.
Defines the security.txt format for publishing vulnerability-reporting contact and policy information.