All tools

Verify a signature, convert its encoding, find out why it does not verify, generate test vectors, see the elliptic-curve arithmetic underneath and split a secret into Shamir shares — every tool runs in your browser.

Sign, decode and verify JSON Web Tokens, decrypt JWEs, read PASETO tokens, generate keys and convert them between JWK, PEM and SSH, and build or check the key sets behind them — with plain explanations of what is wrong.

Decode certificates, signing requests, revocation lists, OCSP answers and Certificate Transparency timestamps; generate a CSR and its key, check that a key, certificate and CSR belong together, compare two certificates, put a chain in order and fetch missing intermediates, compute SPKI pins and test keys for known weaknesses; open PFX files, split PEM bundles, explore raw ASN.1 and build the openssl command you need. Keys stay in your browser; the few checks that need our server say what they send before they send it.

Generate a TLS configuration for your server, get ready for 47-day certificates, publish CAA, TLSA and security.txt records, follow the DNSSEC chain of trust, see whether your browser already uses post-quantum TLS and check many domains at once. Each page says exactly what, if anything, it sends over the network.

Find out why a DKIM signature fails, see what each forwarder recorded in an ARC chain, create the key and DNS record for your own domain, and check a brand’s BIMI record and Mark Certificate. The DKIM and ARC tools analyze messages in your browser and look up only public key names over DNS-over-HTTPS; the full SPF, DKIM, DMARC, ARC, BIMI and MTA-STS analysis runs on our server and sends the message only after you agree.

Decode a raw Ethereum transaction or an EIP-7702 delegation, read what a typed-data signature would hand over before you sign it, verify who signed an Ethereum message or a sign-in, compare a Safe transaction’s hashes with your hardware wallet, look for reused ECDSA nonces, inspect PSBTs and xpubs, and verify Bitcoin (BIP-137/322), Solana and Nostr signatures. Everything runs in your browser; on-chain lookups go to a public RPC node only when you ask. Seed phrases and private keys are never accepted.

Hands-on post-quantum cryptography: sign with ML-DSA and SLH-DSA, encapsulate with ML-KEM and the X25519MLKEM768 hybrid that browsers already use, benchmark 100+ liboqs algorithms, and inspect PQ certificates, HPKE and age — all in your browser, nothing uploaded.

Register and sign in with a real passkey and name the authenticator behind it from the FIDO Metadata Service, validate OpenID Connect ID tokens and SAML responses, inspect the credentials of the EU Digital Identity Wallet (SD-JWT VC and mdoc), DPoP proofs, COSE and CWT, and HTTP requests signed by bots and AI agents. Tokens and keys are checked in your browser; the authenticator lookup asks our server for public metadata only.

Check what a release really is before you run it. Verify Sigstore bundles and npm provenance down to the repository, workflow and commit that built them, read SLSA and in-toto attestations, check SSH-signed Git commits and files against allowed_signers, and inspect the signatures of Windows executables, Android APKs and Java archives. Documents and media too: verify PDF signatures (PAdES, LTV) and signed email (S/MIME) without uploading anything, decode RFC 3161 time-stamps, read the Content Credentials (C2PA) of images and video, and prove a key was generated on a YubiKey. Files and keys stay in your browser; the npm checker asks the public registry for the package you name, and the optional second Sigstore check sends our server only the bundle and the file’s digest.

Paste an armored key, signature or message, or open a .gpg, .sig or .asc file, and see every packet: subkeys, user IDs and self-signatures, expiry and revocation, algorithms including RFC 9580 v6 keys and the new post-quantum IDs. Verify detached, cleartext and inline signatures with the signer’s public key — like gpg --verify, without installing GnuPG. Everything runs in your browser, and private keys are refused unread.