Decoders, validators, and visualizers for the protocols you actually work with — JWT, SAML, OAuth, SCIM. Every tool runs entirely in your browser. No accounts, no tracking, no server submission. Open them straight from a tab.
Paste a JSON Web Token. See the header, payload, claims, and expiry.
Paste a header + payload + key. Get a signed JWT (HS256 / RS256 / ES256).
Generate a PKCE verifier + challenge pair for OAuth 2.1 testing.
Paste an `Authorization: Bearer ...` header. Get a triage on what's inside.
Type a password. See entropy in bits + estimated crack time at multiple attack rates.
Register + verify a passkey in your browser. See the assertion + attestation.
Answer 6 questions. Get a ranked shortlist across CyberArk, BeyondTrust, Delinea, HashiCorp, and more.
The tokens, SAML responses, and SCIM payloads you debug contain secrets — session identifiers, attribute claims, sometimes credentials. Sending those to a third-party decoder is a credential-exposure risk we won’t ask you to take. Every tool here runs entirely in your browser. We don’t log inputs, store results, or run analytics on what you paste.
Open DevTools → Network and confirm: no outbound requests fire while you use these tools.