What kinds of auth problems is this hub built to debug?

It is built for practical flow failures such as PKCE or state mismatches, malformed JWTs, unexpected JWK or HMAC signing behavior, TOTP drift, OTP verification issues, and session or request identifiers that make callback tracing difficult.

How is this different from a broader auth-security or password hub?

This hub focuses on the short-lived artifacts that move through real sign-in and API flows after the password choice is already made: nonce values, PKCE pairs, JWTs, JWKs, HMAC signatures, one-time codes, and trace-friendly identifiers.

When should I use OTP versus TOTP/HOTP tools here?

Use the generic OTP tool when you need standalone verification codes for SMS, email, support, or QA flows. Use TOTP/HOTP tools when you need authenticator-style shared-secret testing, time-window comparison, or counter-based device behavior.

Why include UUID and Base64URL tools next to JWT and JWK pages?

Because auth bugs often hide in the surrounding plumbing rather than the token body alone. UUIDs help correlate requests and sessions, while Base64URL checks help verify encoded headers, claims, PKCE values, and JWK-related token segments.

Elysia Tools

Navigation

secure

Token, Session, and 2FA Workflow Tools

Debug real sign-in flows with PKCE and nonce generators, JWT and JWK inspectors, HMAC verification, OTP and TOTP testing, and auth-safe identifiers collected in one focused workflow hub.

Overview

What this hub helps you accomplish

This hub is for the part of authentication work where a login flow exists on paper but still breaks in practice. You may need to generate PKCE material for an OAuth callback, inspect a JWT that came back from an identity provider, verify whether a JWK or HMAC secret matches the signing behavior you expect, test how one-time codes drift across devices, or attach cleaner request and session identifiers while reproducing the bug. It keeps short-lived auth artifacts together so teams can move from “the sign-in flow feels wrong” to a precise reproduction across browser login, mobile callbacks, API handoffs, and MFA recovery paths without bouncing between unrelated security pages.

Tools

Tools inside this hub

Samples

Sample stories related to this hub

Hubs

Token, Session, and 2FA Workflow Tools

What this hub helps you accomplish

Tools inside this hub

Sample stories related to this hub

Continue with adjacent topic clusters

Learn when to use this tool, what it supports, and how real users apply it.

Overview

When to use

How it works

Use cases

FAQ

Secure Random Generator

Nonce & Token Generator

Base64URL Encoder/Decoder

JWT Generator

JWT Decoder

JWT Decoder & Security Auditor

JWK Generator & Parser

Key Pair Generator

RSA Key Pair Generator

HMAC Generator & Verifier

TOTP / HOTP Offline Code Generator

Numeric OTP Generator

UUID Generator

UUID Validator

JWT Samples

OAuth 2.0 Samples

OAuth 2.0 & OpenID Connect Samples

WebAuthn Passwordless Authentication

Authentication, Password, and Token Security Tools

Key Generation, Signatures, and Trust Verification Tools

API Request Replay, Snippet, and Runtime Debugging Tools

API Contract Testing, Mocking, and Schema Review Tools