Tools for security: passwords, JWT, UUID, SHA
Generate passwords with an entropy hint, decode JWT claims, mint UUIDs and SHA-256 files. Local only.
Generate a unique password per account. Length and alphabet size drive entropy; a single extra symbol on an 8-character string does little. Store the result in a manager, not in chat.
JWT decode shows header and payload. Treat it as a flashlight, not a verifier. A valid-looking token with an “none” alg or an expired exp is still garbage until a server checks the signature.
UUIDs are identifiers. Hashing a file with SHA-256 is for integrity of a download. Do not hash a password with raw SHA-256 and call it storage; that is not a password scheme.
A local security check is a password you can actually remember the entropy of, a JWT you decode without sending it anywhere, a UUID that does not leak a MAC address, and a hash you recompute on a download. None of these verify a remote system. This page groups the four tools. Signature checking of a JWT still belongs on your server.
FAQ
Can I verify JWT here?
No. You need the key material on a trusted backend.
Is the password saved?
No. Copy it and close the tab.
SHA-256 for passwords?
Use the generator. SHA-256 without salt and stretching is not how you store logins.