Are my private keys and certificates safe to use here?
Yes. Every operation runs inside your browser on its own crypto and text APIs — there is no module to download and no request to a server. Your certificates, private keys, tokens and plaintext are not uploaded, not stored, and not written to the console.
Which certificate formats can I convert between?
PEM to DER and DER to PEM, in either direction, including files that hold several blocks such as a certificate with its intermediates. PKCS#12 bundles (.pfx, .p12) are not supported; use OpenSSL or your platform's certificate manager for those.
What hash algorithms does the hash generator support?
MD5, SHA-1, SHA-256, SHA-384 and SHA-512, all computed from the same input in one pass, so there is no algorithm to choose. Each is returned as a lowercase hex digest with its own copy button, and a compare field checks any of them against a published checksum.
Can I use this to debug or validate JWT tokens?
Yes. JWT Sign builds a token from claims you write and a shared secret, using HS256, HS384 or HS512. JWT Verify decodes the header and payload without any secret, and reports the signature and the expiry separately — a correctly signed token can be long out of date, and an in-date one can be forged.
What does the CSR Generator produce?
A PEM certificate signing request and its private key, as two separate downloads that are never joined into one block. Keys are RSA 2048, 3072 or 4096, or ECDSA on P-256 or P-384, and subject alternative names go in alongside the common name.
Can I encrypt something here?
Not on this page. Encryption lives in its own tool, the AES encryptor at /tools/security/aes-encryptor, which handles files and text. What this page covers is conversion, inspection, encoding, hashing, signing and generation — operations that need no key you have to keep.
