Source
Input JSON
0 chars0 B
⌘Enter format · ⌘ShiftEnter validate · ⌘K commands
Developer utility
Hash, HMAC & AES Encryption Utility
Hash, sign and encrypt text locally with the Web Crypto API.
Free toolkit with a JSON formatter, encoder/decoder, encryption utility and JWT parser.
Everything is processed locally in your browser and is never uploaded.
Result
Output
Formatted output will appear here.
Format or validate JSON to explore it as a tree.
Large containers are rendered on demand. A maximum of 500 items is shown per expanded container.
Format or validate JSON to see its structure and size.
Structural comparison
Compare two JSON documents
Whitespace and property formatting are ignored.
Add two valid JSON documents to compare them.
Local code generation
Generate models from your JSON
Types are inferred from the current parsed JSON; review generated code before using it in production.
Format or validate JSON to generate typed models.
Local conversion
JSON → CSV
Works with a top-level array of objects. Nested objects become dotted columns; arrays are kept as JSON inside a cell.
Format or validate a top-level array of objects to convert it.
Local conversion
Encoder / Decoder
Convert text between Base64, Base64URL, percent-encoded URLs, HTML entities, hex and binary, or apply ROT13 and simple text transforms. Everything is computed in your browser.
Ready — choose a transformation and start typing.
Web Crypto, locally
Encryption Utility
Create SHA-2 hashes, HMAC signatures and AES-GCM or AES-CBC ciphertext right here. AES keys are derived from your passphrase with PBKDF2 (150,000 iterations, SHA-256) plus a random salt and IV that travel with the ciphertext.
Ciphertext envelope: v1:salt:iv:data in the selected format.
Ready — choose an operation and enter your text.
Password studio
Strong password & key generator
Random values come from crypto.getRandomValues. Nothing is stored, logged or transmitted — copy what you need before leaving the page.
Choose a length and character set, then generate.
Decode and verify
JWT Parser
Decode the header, payload and signature of a JSON Web Token, inspect its registered claims, and optionally verify HS, RS, PS or ES signatures locally. Tokens are never uploaded.
Not verified
Paste a token, then choose Decode token.
Header
Payload
Registered claims
Signature
About the Encryption Utility
This tab wraps the cryptography your browser already ships with: SHA-2 digests, HMAC signatures, and AES encryption with keys derived from a passphrase. AES keys come from PBKDF2 with 150,000 iterations of SHA-256 and a fresh random 16-byte salt, and the salt and IV are packed into a compact envelope (v1:salt:iv:data) so every ciphertext is self-contained and can be decrypted later from the same passphrase. AES-GCM authenticates the data, so a wrong passphrase or a tampered payload is detected immediately; AES-CBC remains available for interoperability.
What you can do
- SHA-256, SHA-384 and SHA-512 digests in Base64 or hex.
- HMAC-SHA256, HMAC-SHA384 and HMAC-SHA512 signatures.
- AES-GCM (128-bit authentication tag) and AES-CBC encryption and decryption.
- PBKDF2-HMAC-SHA256 key derivation with 150,000 iterations and a random salt.
- Self-describing ciphertext envelopes that travel with their salt and IV.
- Strong password generator with length, character classes, look-alike filtering and an entropy estimate.
How to use the Encryption Utility
- Choose an operation: a digest, an HMAC signature, or AES encrypt and decrypt.
- Enter the text, plus the secret or passphrase when the operation requires one.
- Run the operation, then copy the digest, signature or ciphertext envelope.
Keyboard shortcut: press Alt+1 to Alt+4 to move between tools, or ⌘K for the command palette.
Frequently asked questions
- Why does the encryption tab ask for HTTPS?
- The Web Crypto API (crypto.subtle) only exists in a secure context. Serve the page over HTTPS or open it on localhost; every other part of the toolkit works without it.
- Should I use AES-GCM or AES-CBC?
- Prefer AES-GCM, which authenticates the ciphertext so decryption fails loudly when the passphrase is wrong or the data was altered. Choose AES-CBC only when another system demands it, and confirm the plaintext looks right.
- How strong is the key derivation?
- PBKDF2-HMAC-SHA256 with 150,000 iterations and a random 16-byte salt, the current browser recommendation for passphrase-based encryption. A long, unique passphrase still matters most.
- Do I need to remember the salt or IV?
- No. Both are stored inside the ciphertext envelope in the order v1:salt:iv:data, so the only thing you have to keep is the passphrase.
More free developer tools
- JSON Formatter & Validator Format, validate, explore and analyze JSON instantly.
- Base64, URL & Hex Encoder / Decoder Encode and decode Base64, URL, HTML, hex and binary text instantly.
- JWT Decoder & Signature Verifier Decode and verify JSON Web Tokens, claims and signatures.
Every tool on this site runs entirely in your browser. Nothing you paste is uploaded, stored or logged, and no account is required.