Tool comparison
Hash Generator vs JWT Decoder
Hash Generator (cryptography) and JWT Decoder (encoding) come from different categories but appear together in developer workflows. This guide explains what each does and when to reach for one over the other.
Bottom line
Hash Generator produces fixed-length fingerprints (MD5, SHA-256) used to verify data integrity. JWT Decoder parses tokens whose signature is itself a hash of the header and payload. Use Hash Generator to create or verify checksums; use JWT Decoder to inspect the claims inside a signed token.
What each tool does
Hash Generator
A cryptographic hash function takes an input of any length and produces a fixed-size output — the hash or digest — that uniquely represents the input. The same input always produces the same hash; changing even a single character produces a completely different hash. Hash functions are one-way: you cannot reverse a hash to recover the original input. MD5 and SHA-1 are older algorithms still used for non-security checksums. SHA-256 and SHA-512 are current standards for security-sensitive use cases such as digital signatures, API authentication, and password storage (always combined with a proper key-derivation function like bcrypt or Argon2 for passwords).
Open Hash Generator →JWT Decoder
A JSON Web Token (JWT) is a compact, URL-safe string used to securely transmit claims between two parties. It consists of three base64url-encoded segments separated by dots: a header, a payload, and a signature. The header specifies the signing algorithm (such as HS256, RS256, or ES256). The payload contains claims — statements about an entity and additional metadata, such as a user ID (sub), an expiry time (exp), an issuer (iss), and any custom application-defined fields. The signature is computed over the header and payload using a secret or private key, allowing the recipient to verify that the token was issued by a trusted source and has not been modified. JWTs are the standard mechanism for stateless authentication in modern web applications: once issued, they travel with every API request (typically in the Authorization: Bearer header) and can be validated without a database lookup. This tool decodes the header and payload instantly without requiring a key, and can optionally verify the signature using your HMAC secret or RSA/ECDSA public key — all within your browser.
Open JWT Decoder →Side-by-side comparison
| Feature | Hash Generator | JWT Decoder |
|---|---|---|
| Category | cryptography | encoding |
| Primary purpose | Generate MD5, SHA-1, SHA-256, SHA-384, or SHA-512 hashes from any text input. | Decode and verify JSON Web Tokens — header, payload, claims, and signature. |
| Inputs | input, algorithm, encoding | token, secret, algorithm |
| Outputs | hash, algorithm, encoding, input_byte_length, digest_length | header, payload, signature, valid_structure, verified |
When to use each
Use Hash Generator when…
How to verify a SHA-256 checksum online
Confirm that a downloaded string or file content matches a known SHA-256 hash.
How to generate an MD5 hash online
Quickly compute an MD5 digest of a string for a legacy API or non-security checksum.
Use JWT Decoder when…
How to decode a JWT in your browser
Instantly inspect the header and payload of any JWT without installing software.
How to inspect an Auth0 JWT token
Read the claims inside an Auth0 access token or ID token to debug permissions and user data.
Frequently asked questions
- Is my input sent to a server?
- No. Hashing runs entirely in your browser using the Web Crypto API. Your text never leaves your device. The REST API endpoint processes input server-side in an isolated, stateless function with no logging.
- Which algorithm should I use?
- Use SHA-256 for new projects — it is the current standard for digital signatures, API authentication, and data integrity. Use MD5 or SHA-1 only when a legacy system requires it; both are broken for collision resistance but still acceptable for non-security checksums like file integrity verification. Use SHA-512 when you need a 512-bit digest or when a framework specifically requires it.
- Does this verify the signature?
- Yes — enter your HMAC secret or RSA/ECDSA public key in the Verify section. For HS* algorithms the secret is a plain text string; for RS*/ES* provide a PEM-formatted public key matching the private key that signed the token.
- Is my token sent to a server?
- The browser-side decoder never makes a network call — decoding is done entirely in JavaScript. The signature-verification call does send your token and key over HTTPS to a server-side endpoint, but neither is logged or stored.