DevCoreTools

Security & Crypto Guide

Security & Crypto Guide for hashes, HMACs, passwords, and JWTs

Developers often need to generate hashes, compare checksums, create HMAC signatures, generate strong passwords, inspect JWTs, and verify token signatures during API, authentication, and debugging workflows. This guide helps you choose the right DevCoreTools security utility for the task.

Which security or crypto tool should I use?

Start with the workflow you need to debug. These tools handle common security-adjacent values locally in your browser, from file checksums to API signatures and token timestamps.

Create checksums or compare digestsHash GeneratorCreate a keyed message signatureHMAC GeneratorGenerate strong random passwordsPassword GeneratorInspect JWT header and payloadJWT DecoderVerify a JWT signature and claimsJWT VerifierDecode encoded token or API valuesBase64 Encoder/DecoderConvert token and log timestampsUnix Timestamp Converter

Hashes and checksums

A hash is a one-way digest of input bytes. Developers use hashes for checksums, fingerprints, comparisons, and integrity checks because the same input and algorithm produce the same output.

Use the Hash Generator to generate or compare digests such as SHA-256 and SHA-512. MD5 and SHA-1 may still appear in legacy checksum workflows, but they should not be treated as secure protection against intentional tampering.

HMAC signatures

HMAC combines a message with a secret key to create a keyed signature. A system with the same secret can recompute the HMAC and compare it to check authenticity and integrity.

Use the HMAC Generator when testing webhook signatures, signed API requests, or shared-secret examples. HMAC-SHA256 is a common modern default, but always match the exact algorithm, key encoding, message bytes, and output encoding required by the integration.

Secure password generation

Password generation should focus on length, randomness, and avoiding reuse. A long random password stored in a trusted password manager is usually better than a short password with predictable substitutions.

Use the Password Generator for random passwords and test credentials. Do not reuse generated passwords across accounts, and avoid placing passwords in source code, logs, tickets, chat messages, or unsecured notes.

JWT decoding and verification

JWT decoding reads the header and payload. JWT verification checks the signature and trust rules, such as issuer, audience, expiration, and not-before timing. Decoding is not the same as verification.

Use the JWT Decoder to inspect token contents, and the JWT Verifier when you need to check a signature and claims. For a deeper token-specific walkthrough, read the JWT Guide.

Encoding vs encryption vs hashing vs signing

Encoding

Transforms data into another representation, such as Base64. It is reversible and does not provide secrecy.

Hashing

Creates a one-way digest for comparison or integrity checks. It is not designed to be reversed.

Encryption

Protects confidentiality by making data readable only to someone with the right key.

Signing

Checks authenticity and integrity. HMAC uses a shared secret; other signature systems may use public keys.

Common security debugging mistakes

Trust mistakes

  • Treating decoded JWT payloads as verified.
  • Using MD5 or SHA-1 as modern cryptographic protection.
  • Assuming Base64 encoding hides sensitive data.

Input mistakes

  • Hashing text when the workflow requires the original file bytes.
  • Signing a reformatted message instead of the exact canonical bytes.
  • Mixing timestamp seconds and milliseconds during token debugging.

Secret-handling mistakes

  • Pasting real production secrets into untrusted tools.
  • Reusing passwords or API keys across environments.
  • Leaving tokens, keys, or generated passwords in logs or tickets.

Never paste real production secrets, API keys, private keys, passwords, customer data, or sensitive tokens into untrusted tools. DevCoreTools utilities are designed for local, browser-based workflows.

Security & Crypto Guide FAQ

What is a hash used for?

A hash is used to create a one-way digest for checksums, fingerprints, comparisons, and integrity checks.

Is hashing the same as encryption?

No. Hashing is one-way and used for comparison. Encryption is designed to be reversible with the right key.

What is an HMAC?

An HMAC is a keyed message authentication code created from a message, a secret key, and a hash algorithm.

What is the difference between a hash and an HMAC?

A hash uses only the input. An HMAC also requires a secret key, so it can support authenticity and integrity checks.

Is MD5 secure?

No. MD5 has known collision weaknesses. It may appear in legacy checksum workflows, but avoid it for modern security use.

How long should a generated password be?

Use at least 16 characters when a service allows it. Longer random passwords are usually stronger.

Is decoding a JWT the same as verifying it?

No. Decoding reads token content. Verification checks the signature and expected trust rules.

Can I safely use browser-based crypto tools?

Browser-based tools are useful for local debugging, but avoid pasting production secrets or sensitive customer data into tools you do not trust.