Inspect and sign JWTs, convert JSON/YAML/CSV, analyze Base64 & hex dumps, dissect URLs, compute HMAC hashes, convert timestamps, forge UUIDv7s, and generate secure passwords. Tokens, secrets, and private keys never leave your device.
Each utility has been moved into its own dedicated, focused page with expansive layouts, deep linking, sample loaders, and specialized keyboard workflows.
The ultimate JSON Web Token laboratory. Color-coded header, payload, and signature inspection with real-time claim descriptions, expiry warnings, and full key verification. Sign new tokens with automatic keypair generation.
#token=... (never sent to server)Format, minify, and inspect structured data with collapsible nodes, line numbers, and bidirectional conversion between JSON, YAML, and CSV.
Encode and decode UTF-8 text or binary files. Includes URL-safe base64url mode and an xxd-style hexadecimal byte dump viewer.
Percent-encode and decode strings or complete URLs. Automatically breaks down URLs into structured component tables and query parameters.
Compute hardware-accelerated SHA checksums of text or files, or sign with HMAC secret keys for webhook verification and API signatures.
Convert between Unix timestamps and readable date strings across timezones, with smart precision sniffing and relative human time offsets.
Generate bulk random (v4) or time-ordered (v7) UUIDs, or inspect existing UUIDs to extract version, variant, and creation timestamps.
Generate truly random, high-entropy passwords using Web Crypto CSPRNG with customizable charsets and real-time Shannon entropy scoring.
Pasting production JWTs, private keys, or passwords into standard online developer portals is a significant security risk. Here is how Sanctum guarantees your privacy.
Sanctum runs entirely inside your browser's V8 or JavaScriptCore runtime. There is no backend API, no database, and no server ingestion. The network tab shows 0 outbound requests.
Cryptographic signing, verification, hashing, and password entropy utilize the W3C SubtleCrypto API. Cryptographic operations run in secure browser memory with hardware acceleration.
No Google Analytics, no Mixpanel, no Facebook pixels, no session recorders, and no third-party CDNs. Your tokens, passwords, and private keys never touch any third party.
| Security Factor | Sanctum | Typical Online Utility Sites |
|---|---|---|
| Data Destination | 100% inside your local browser tab | Sent over network to cloud servers |
| Secret / Key Privacy | Kept strictly in JavaScript memory | Logged in server logs or proxy caches |
| Analytics & Cookies | Zero cookies, zero analytics, zero trackers | Ad trackers, session recordings, cookies |
| Deep Link Privacy | Uses URL #hash (never sent to server) |
Sends sensitive parameters in query string |
| Offline Readiness | Works fully offline with no connection | Fails immediately without server connectivity |
Sanctum is engineered to adhere strictly to published IETF and W3C open standards.
| HS256 / 384 / 512 | HMAC with SHA-2 family |
|---|---|
| RS256 / 384 / 512 | RSASSA-PKCS1-v1_5 with SHA-2 |
| PS256 / 384 / 512 | RSASSA-PSS with SHA-2 and salt |
| ES256 / 384 / 512 | ECDSA over P-256, P-384, and P-521 curves |
| Key Formats | SPKI PEM, PKCS#8 PEM, JWK, and JWKS |
| RFC 9562 UUIDv7 | Millisecond Unix time + 74 bits random entropy |
|---|---|
| RFC 9562 UUIDv4 | 122 bits cryptographically random entropy |
| RFC 4648 Base64 | Standard (+/) and URL-safe base64url (-_) |
| RFC 4180 CSV | Quoting, escaping, and sniffed delimiters |
| RFC 7231 HTTP Date | IMF-fixdate HTTP header format |