Security-related tasks appear throughout development — hashing passwords for tests, verifying HMAC signatures, generating strong secrets, decoding JWT claims, or encoding credentials for Basic Auth. WoDeTool's Security scenario collects cryptography and encoding utilities that run locally in your browser, so test material never needs a random third-party paste site.
Hashing, HMAC, and passwords
Hash Generator computes MD5, SHA-1, SHA-256, and other digests for sample strings — useful when comparing your implementation against known test vectors or documenting expected hash outputs in API specs.
HMAC Generator builds keyed hashes for webhook signature verification tutorials. Supply the secret and message body to reproduce what your server should validate.
Password Generator creates random passwords with configurable length and character sets — for staging accounts, demo users, or rotating test credentials (never reuse generator output as production secrets without your org's policy).
Tokens and encoding
JWT Decoder inspects header and payload without verifying signature — ideal for debugging auth flows, checking `aud`/`iss` claims, and confirming expiry before blaming the API gateway.
Base64 Encode/Decode handles binary-safe transport of small secrets or JSON blobs in headers. Basic Auth Generator wraps username:password into the standard Authorization header format.
Safe usage guidelines
WoDeTool processes these inputs locally and does not store tool content on servers. Still, treat any online tool as untrusted for live production keys — use synthetic secrets in demos.
After debugging, rotate any credential that was pasted into a browser tab on a shared machine. Pair these tools with your team's secret management policy, not as a replacement for vaults.
Pipeline for auth debugging
When verifying webhook signatures: HMAC Generator → compare with server output. For Basic Auth headers: Basic Auth Generator → paste into Postman. Save as "Auth debug" for repeat testing.
All crypto utilities here run locally — still use synthetic secrets, never production keys.