# Token, Session, and 2FA Workflow Tools

Debug real sign-in flows with PKCE and nonce generators, JWT and JWK inspectors, HMAC verification, OTP and TOTP testing, and auth-safe identifiers collected in one focused workflow hub.

> Canonical page: https://elysiatools.com/en/hubs/token-session-and-2fa-workflows

- **Category:** secure

- **Keywords:** token workflow tools, session nonce and pkce generator, jwt inspector and security auditor, jwk and signing key tools, hmac token verification, totp and otp testing tools, oauth openid connect auth samples, uuid and auth identifier generator

## Overview

This hub is for the part of authentication work where a login flow exists on paper but still breaks in practice. You may need to generate PKCE material for an OAuth callback, inspect a JWT that came back from an identity provider, verify whether a JWK or HMAC secret matches the signing behavior you expect, test how one-time codes drift across devices, or attach cleaner request and session identifiers while reproducing the bug. It keeps short-lived auth artifacts together so teams can move from “the sign-in flow feels wrong” to a precise reproduction across browser login, mobile callbacks, API handoffs, and MFA recovery paths without bouncing between unrelated security pages.

## Tools

- Secure Random Generator: Generate cryptographically secure random key material driven by entropy budget — request N bits of entropy, get hex/base64/base64url output. Also supports custom-alphabet strings via crypto.randomInt (rejection-sampled, no modulo bias). Use this instead of Math.random()-based tools for any secret/key/token.
- Nonce & Token Generator: Generate cryptographically secure one-time tokens for web security scenarios — CSRF tokens, OAuth/OIDC state parameters, session nonces, and PKCE code_verifier/code_challenge (S256). Uses crypto.randomBytes, never Math.random.
- Base64URL Encoder/Decoder: Encode and decode Base64URL (URL-safe Base64 variant used by JWT/JWS/JWE), with conversions between standard and URL-safe Base64
- JWT Generator: Generate JWT tokens with custom claims and algorithms
- JWT Decoder: Decode JWT tokens
- JWT Decoder & Security Auditor: Decode JWT header and payload, verify HS256 or RS256 signatures, and flag algorithm, expiry, and sensitive-claim security risks
- JWK Generator & Parser: Generate JSON Web Keys (JWK) for RSA, EC (P-256/P-384/P-521/secp256k1), and OKP (Ed25519/Ed448/X25519/X448), or parse an existing JWK to inspect its parameters, thumbprint, and metadata
- Key Pair Generator: Generate public/private key pairs for various cryptographic algorithms
- RSA Key Pair Generator: Generate an RSA key pair (2048/3072/4096-bit) as PEM-encoded public and private keys. Optionally encrypt the private key with a passphrase. PKCS#8 (recommended) or PKCS#1 private key format. Everything runs locally.
- HMAC Generator & Verifier: Compute an HMAC message-authentication signature over a message + shared secret using SHA-1/SHA-2/SHA-3/BLAKE2, or verify an incoming signature against the secret — with webhook presets for Stripe / Slack / GitHub and constant-time comparison
- TOTP / HOTP Offline Code Generator: Generate RFC 6238 TOTP (time-based, 6/8 digits, 30/60s step) and RFC 4226 HOTP (counter-based) one-time passwords from a base32 shared secret, fully offline with HMAC-SHA1/256/512, plus an otpauth:// URI for importing into Google Authenticator / Authy
- Numeric OTP Generator: Generate cryptographically secure one-time numeric codes (SMS / email verification, raffle codes, event pins) with configurable length (3-10 digits), bulk output, optional ambiguous-digit exclusion, and an optional expiry countdown. Uses crypto.randomInt, not Math.random.
- UUID Generator: Generate UUIDs (v1, v4, v5)
- UUID Validator: Validate UUID format, detect version, and analyze UUID structure including variant, timestamp, and node information

## Samples

- JWT Samples: Comprehensive JWT examples from basic token structure to advanced security implementations
- OAuth 2.0 Samples: OAuth 2.0 implementation examples including authorization flows, client configurations, and security best practices
- OAuth 2.0 & OpenID Connect Samples: OAuth 2.0 authorization framework and OpenID Connect authentication protocol examples
- WebAuthn Passwordless Authentication: Web Authentication API examples with biometric authentication, security keys, and passwordless login systems

## Frequently asked questions

### What kinds of auth problems is this hub built to debug?

It is built for practical flow failures such as PKCE or state mismatches, malformed JWTs, unexpected JWK or HMAC signing behavior, TOTP drift, OTP verification issues, and session or request identifiers that make callback tracing difficult.

### How is this different from a broader auth-security or password hub?

This hub focuses on the short-lived artifacts that move through real sign-in and API flows after the password choice is already made: nonce values, PKCE pairs, JWTs, JWKs, HMAC signatures, one-time codes, and trace-friendly identifiers.

### When should I use OTP versus TOTP/HOTP tools here?

Use the generic OTP tool when you need standalone verification codes for SMS, email, support, or QA flows. Use TOTP/HOTP tools when you need authenticator-style shared-secret testing, time-window comparison, or counter-based device behavior.

### Why include UUID and Base64URL tools next to JWT and JWK pages?

Because auth bugs often hide in the surrounding plumbing rather than the token body alone. UUIDs help correlate requests and sessions, while Base64URL checks help verify encoded headers, claims, PKCE values, and JWK-related token segments.

## Related content

- [Authentication, Password, and Token Security Tools](https://elysiatools.com/en/hubs/auth-token-security): Generate and validate passwords, review JWTs, compare password-hash workflows, and inspect auth-related security basics in one hub.
- [Key Generation, Signatures, and Trust Verification Tools](https://elysiatools.com/en/hubs/key-generation-signature-verification): Generate key material, inspect JWT and AGEX signatures, verify PDF and TLS certificates, and compare hashes in one focused trust-checking hub.
- [API Request Replay, Snippet, and Runtime Debugging Tools](https://elysiatools.com/en/hubs/api-request-replay-and-debugging): Turn broken HTTP calls into reproducible cases with cURL-to-code converters, webhook capture and replay, HMAC verification, response diffing, header audits, TLS inspection, and request-path debugging tools.
- [API Contract Testing, Mocking, and Schema Review Tools](https://elysiatools.com/en/hubs/api-contract-testing): Generate types and docs from OpenAPI, spin up mocks, validate real responses, and review breaking schema changes in one API contract hub.