Security Tools

ArrayKit's Security tools cover the everyday cryptographic and authentication chores developers hit while building and debugging apps. Inspect a token's claims and expiry with the JWT Decoder, or mint one using the JWT Signer with HS256/384/512. Compute SHA-256, SHA-1, SHA-384, and SHA-512 digests with the Hash Generator to verify checksums and file integrity. Create strong credentials with the Password Generator and time-based codes with the TOTP / 2FA Generator. For key management, the SSH Key Generator produces Ed25519, RSA, and ECDSA keypairs, the PPK to PEM Converter moves keys between PuTTY and OpenSSH, and the Basic Auth Generator builds and decodes HTTP Authorization headers. Every operation runs on your device using standard browser cryptography, so secrets, tokens, keys, and passwords are processed locally and nothing is uploaded.

• JWT Decoder — Decode JWT header & payload and inspect exp / iat (no verification).
• Hash Generator — SHA-256 / SHA-1 / SHA-384 / SHA-512 via the Web Crypto API.
• Password Generator — Generate strong, random passwords with a strength meter (crypto-secure).
• SSH Key Generator — Generate Ed25519, RSA or ECDSA SSH keypairs in your browser and download the public and private keys.
• PPK ↔ PEM Converter — Convert SSH private keys between PuTTY .ppk and OpenSSH/PEM (RSA & Ed25519) — locally in your browser.
• TOTP / 2FA Generator — Generate time-based one-time passwords (2FA codes) from a base32 secret.
• JWT Signer — Create and sign a JWT (HS256/384/512) from a payload and secret — Web Crypto.
• Basic Auth Generator — Generate and decode HTTP Basic Auth Authorization headers from a username and password.
• Certificate & Private Key Matcher — Confirm an X.509 certificate or CSR and a private key belong together (the classic modulus mismatch check) — locally in your browser.
• PFX to PEM Extractor — Open a password-protected .pfx/.p12 file and split it into certificate, chain, and private-key PEM blocks.
• Bcrypt Generator — Hash a password with bcrypt and verify a password against a bcrypt hash, in your browser.
• HMAC Generator — Generate an HMAC (SHA-256, SHA-1, SHA-512) from a message and secret key using Web Crypto.
• Password Strength Checker — Check password strength with entropy, character-set and common-pattern analysis, in your browser.
• X.509 Certificate Decoder — Decode a PEM or DER certificate to view subject, issuer, validity, SANs and fingerprints.
• Diceware Passphrase Generator — Generate a memorable, high-entropy passphrase from the EFF word list, in your browser.
• CSP Analyzer — Parse a Content-Security-Policy header into a directive table with warnings and explanations.
• File Hash Checksum — Compute MD5, SHA-1, SHA-256 and SHA-512 checksums of files and compare against an expected hash.
• IBAN Generator & Validator — Generate valid test IBANs by country and validate any IBAN with MOD-97 check digits.
• AES Encrypt / Decrypt — Encrypt and decrypt text with AES-GCM and a passphrase, using Web Crypto in your browser.
• SHA-3 & Keccak Hash Generator — Hash text or hex with SHA-3, Keccak-256 and SHAKE, for Ethereum and general use.
• MD5 Hash Generator — Generate an MD5 hash of text or a file, in your browser.
• CRC32 Checksum Calculator — Compute a CRC32 checksum of text as hex and decimal, in your browser.
• CSR Decoder — Read a certificate signing request: subject, SANs, key size and signature check.

Frequently asked questions

What can ArrayKit's Security tools do?

They cover the common crypto and auth tasks in one place: decode and sign JWTs, generate SHA hashes, create strong passwords, produce TOTP 2FA codes, generate SSH keypairs, convert keys between PuTTY .ppk and OpenSSH/PEM, and build or decode HTTP Basic Auth headers.

Is my data private when I use these Security tools?

Yes. Every tool runs on your device using standard browser cryptography, so tokens, hashes, passwords, SSH keys, and credentials are processed locally. Your data never leaves your device and ArrayKit does no tracking of what you enter.

Do the Security tools work offline?

Once the page has loaded, the tools run client-side, so hashing, signing, key generation, password creation, and JWT decoding keep working without a live connection. Loading the page for the first time still needs the internet.

Which SSH key formats are supported?

The SSH Key Generator creates Ed25519, RSA 2048/4096, and ECDSA P-256/384/521 keypairs with OpenSSH public keys and PEM private keys. The PPK to PEM Converter turns PuTTY .ppk keys into OpenSSH/PKCS#8 PEM and back, for RSA and Ed25519 keys.

Can I both create and inspect JWTs here?

Yes. Use the JWT Signer to build and sign a token from a payload and secret with HS256, HS384, or HS512, then paste the result into the JWT Decoder to read the header, payload, and exp/iat/nbf claims. The decoder does not verify signatures.

Are the passwords and 2FA codes generated securely?

The Password Generator draws from a cryptographically secure random source and shows a strength meter, while the TOTP / 2FA Generator produces standard time-based codes from a base32 secret. Both run locally in your browser.