Tokens, secrets, staging gates
Dev Auth Ops groups Tools.Town utilities for inspecting JWTs, generating strong secrets, and creating Basic Auth entries for staging — with safety copy first.
Never paste production secrets into random websites. Prefer Tools.Town’s client-side tools, and rotate anything that might have been exposed.
Workflow
Inspect
Decode a JWT and check exp/nbf claims locally.
→
Decide
JWT vs session cookies — pick the right model.
→
Generate
Diceware or password generator for managers.
→
Stage
htpasswd for Apache/Nginx Basic Auth.
Start here
Backend / FE
Debug expired JWTs from API responses.
Everyone
Diceware passphrase for a password manager.
DevOps
Create htpasswd for staging Basic Auth.
Architect
Read JWT vs session cookies guide.
Tools
| Tool | Best for |
|---|---|
| JWT Decoder | Inspect header/payload/expiry |
| JWT Generator | Sign test HS* tokens locally |
| Diceware Passphrase | Memorable high-entropy phrases |
| Password Generator | Random character passwords |
| Password Strength Meter | Entropy check |
| HTPasswd Generator | Staging Basic Auth lines |
| SHA-256 / MD5 | Checksums — not password storage |
| HMAC Generator | Webhook / API request signatures |
Use cases
- Debug an expired JWT from an API response
- Generate a diceware passphrase for a password manager
- Check password entropy before saving
- Create htpasswd for staging Basic Auth
- Hash a file checksum (not a password)
- Sign a webhook payload with HMAC