JWT, Base64, Base32, and QR Codes

JSON Web Tokens (JWT)

A JWT commonly consists of three dot-separated components:

header.payload.signature

The header and payload are typically Base64url-encoded JSON.

Decode a JWT

1. Select JWT.
2. Paste the token.
3. Click Decode.
4. Review the header, payload, and signature.

Decoded Output

The tool displays the header and payload as formatted JSON.

A header might resemble:

{
  "alg": "HS256",
  "typ": "JWT"
}

A payload might resemble:

{
  "sub": "1234567890",
  "role": "reader"
}

Decoding does not verify the token.

Anyone can decode ordinary JWT header and payload data.

Do not place confidential information in an unencrypted JWT payload.

JWT Signature Verification

Cryptology Monster supports HMAC-based JWT verification.

Supported Algorithms

Usage

1. Paste the JWT.
2. Enter its shared secret.
3. Enable Secret is hex if the secret is hexadecimal.
4. Click *Verify Signature (HS)**.
5. Review the result.

The application reads the token's alg header to select the corresponding HMAC algorithm.

Verification Results

HS* signature is VALID

or:

Invalid signature

Important Limitations

The implementation verifies HMAC signatures only.

It does not support RS256, ES256, EdDSA, or other asymmetric JWT signature algorithms.

It also does not independently validate claims such as:

• exp — Expiration
• nbf — Not before
• iss — Issuer
• aud — Audience

A valid signature alone does not establish that a token is authorized for a particular application.

Do not use this utility as a complete JWT authorization system.

Base64 Encoding

Base64 converts data into printable characters.

Encode

1. Select Base64.
2. Enter text.
3. Click Encode.

Example:

Hello

becomes:

SGVsbG8=

Decode

Enter:

SGVsbG8=

and click Decode to recover:

Hello

Limitations

The implementation uses JavaScript's native btoa() and atob() functions directly.

These operate on byte-oriented character strings and do not automatically perform UTF-8 conversion for arbitrary Unicode text.

Non-Latin characters may fail to encode or may not decode as expected without conversion.

Base32 Encoding

Base32 represents data using the following alphabet:

ABCDEFGHIJKLMNOPQRSTUVWXYZ234567

Encode

1. Select Base32.
2. Enter text.
3. Click Encode.

Example:

Hello

becomes:

JBSWY3DP

Decode

Paste:

JBSWY3DP

and click Decode to recover:

Hello

Implementation Notes

• Input is converted to uppercase during decoding.
• Trailing = padding is removed before decoding.
• Unrecognized characters are skipped.
• The encoder does not append standard = padding.
• Arbitrary Unicode text is not handled through an explicit UTF-8 conversion.

The implementation works best with byte-compatible text.

Encoding Is Not Encryption

Do not use Base64 or Base32 alone to protect confidential information.

QR Code Generator

Cryptology Monster generates QR codes from text.

Usage

1. Select QR.
2. Enter the text to encode.
3. Click Generate QR.
4. Review the generated code.
5. Download or copy the QR image.

Output

The generator creates a QR code with:

Available Actions

• Download PNG
• Copy to Clipboard

Copying an image to the clipboard requires browser support.

Example Input

https://www.qvlx.com

The generated QR code represents the supplied text.

QR Code Decoder

The decoder reads QR codes from uploaded images.

Usage

1. Select QR.
2. Locate Decode QR.
3. Upload an image containing a QR code.
4. Click Decode from Image.
5. Review the extracted data.

The application uses jsQR to inspect the image pixels.

If no code is detected, it reports:

No QR code found.

QR Code Security

QR codes are a convenient method of encoding information.

They do not establish that embedded content is trustworthy.

A QR code may contain an unsafe website link or other malicious instructions.

Always inspect decoded content before opening links or acting on the embedded information.

Dependencies

QR operations load these libraries as needed:

Tip: JWT decoding, Base64, Base32, and QR codes are primarily data-handling tools. Use a cryptographic verification or encryption tool when authenticity or confidentiality is required.