Security & Crypto
Decode and verify JWTs, generate TOTP codes, inspect certificates, create CSRs and fingerprint SSH keys – all locally.
JWTTOTPX.509SSH
Header
Payload
Sign (HMAC)
Processed entirely in your browser – nothing is sent to the server.
SHA-1, 6 digits and 30 s are what almost all authenticator apps expect. Secrets are never stored.
Current code
Only certificates you paste are analyzed – no domain lookups, no server connections. Processed entirely in your browser – nothing is sent to the server.
Create CSR
One per line: DNS names or IP addresses. The CN is added automatically, as browsers only check SANs.
The private key is generated with WebCrypto and never leaves your browser. Save it now – it cannot be recovered.
Analyze CSR
Paste the contents of id_*.pub or authorized_keys. No SSH connections are made. Processed entirely in your browser – nothing is sent to the server.