Every tool in this group is a pure function of its input. A JSON formatter, a Base64 encoder, a hash function and a regex engine all produce their output from what you paste and nothing else — there is no reason for any of them to involve a server. There is a strong reason for them not to: the things developers paste into these tools are production connection strings, session tokens, API keys, and customer records pulled from a debugging session. Running the transformation locally means that data never becomes someone else's log entry.
The JWT decoder is worth being precise about, because the distinction trips people up constantly. Decoding a JWT is just base64url — the header and payload are encoded, not encrypted, and anyone holding the token can read every claim in it without any key at all. The signature proves the token was not tampered with; it does not hide the contents. So a decoder showing you a payload is not a security failure, but putting anything confidential in that payload is. Our longer write-up on how JWT authentication works and where it breaks covers the failure modes that recur most in production.
On hashing: MD5 and SHA-1 are both broken for collision resistance, with practical collisions demonstrated years ago. They remain perfectly reasonable as non-adversarial checksums — verifying that a download arrived intact, deduplicating files — and are unacceptable anywhere an attacker gets to choose the input, which includes signatures and certificates. Separately, and more importantly: none of the SHA family is password storage. Passwords need a deliberately slow, salted algorithm such as bcrypt, scrypt or Argon2. A fast hash is exactly the wrong property when the attacker has your database and a GPU.
And the one that causes real incidents: Base64 is an encoding, not encryption. It exists to move binary data through channels that only handle text safely. Anything Base64-encoded is trivially readable by anyone who notices — it offers no confidentiality whatsoever.
Picking the right hash
The generator supports several algorithms. They are not interchangeable:
| Algorithm | Output | Safe for checksums? | Safe for security? |
|---|---|---|---|
| MD5 | 128-bit | Yes | No — collisions are practical |
| SHA-1 | 160-bit | Yes | No — deprecated since 2017 |
| SHA-256 | 256-bit | Yes | Yes, for integrity and signatures |
| SHA-384 / SHA-512 | 384 / 512-bit | Yes | Yes, where a longer digest is required |
| Any of the above | — | — | Never for password storage |