Values you would rather not send to a stranger. A token is a credential from the moment it exists, a webhook key is a live secret, and the string you are hashing to debug a signature is usually the exact payload you are least free to share. Every generator in this section produces its output inside your browser, using the random source and the cryptography your operating system already provides.
Calculators in this section
Why that matters here more than anywhere
A secret generated on someone else's server has been known to someone else. No promise about not keeping it can be verified from the outside, and a credential that has crossed a network has a second copy somewhere by definition. Doing the work locally removes the question rather than answering it: open your network tab while you use any of these and nothing is sent, whatever you type.
What is here
A token generator for API keys and passwords, with the character sets and length under your control. A hash generator showing MD5, SHA-1, the SHA-2 family, SHA3-256 and RIPEMD-160 of the same input side by side. A UUID generator covering versions 1, 3, 4 and 5 as well as the NIL value. And an HMAC generator that computes a signature and tells you whether it matches the one you were sent — which is what you actually want at two in the morning when a webhook will not verify.