Elysia Tools
Navigation
Workflow Playbook
Build sanitized auth fixtures, separate token generation from decoding and verification, test OTP/TOTP timing, and audit JWT and session evidence without exposing real secrets.
Hubs
Use this workflow only for your own synthetic fixture or for authentication material covered by explicit authorization. Start with a written test case: which flow is being reproduced, which claims and algorithms are expected, which clock or counter is fixed, and which reviewer can approve the evidence. Keep live access tokens, refresh tokens, cookies, shared secrets, private keys, and recovery codes out of the tool and out of the report.
Create a disposable correlation ID and nonce with secure-random-generator, nonce-generator, and uuid-generator. Validate the identifier format, then use jwt-generator for a token whose claims intentionally cover the case under investigation. For MFA, choose otp-generator for a standalone numeric code or totp-hotp-offline-generator for a disposable Base32 seed plus a fixed time step or counter. Write down the expected values so a later failure is reproducible rather than guessed.
jwt-decoder and base64url-encoder help answer whether the token is well-formed and how its segments are represented. They do not establish authenticity. jwk-generator can create or inspect a disposable key or an authorized public JWK; do not import a private production key merely to make a local check pass. Use hmac-generator-verifier and the supported signature or expiry checks in jwt-decoder-security-auditor only with controlled material and explicit expectations.
After the verification result, review algorithm selection, expiry and not-before behavior, sensitive claims, TOTP/HOTP clock or counter assumptions, and the link between the evidence and its request or session ID. A decode result, a signature match, and a security finding answer different questions. Record them in separate fields so a parseable token is not mistaken for an authorized session.
The final package should contain the test scope, fixture version, correlation ID, expected and observed outcomes, redacted excerpts or fingerprints, residual uncertainty, and the authorized next action. It should not contain a reusable secret or live session artifact. A local tool result is evidence for debugging; only the authorized application test can establish how the server handled the request.
Workflow playbook
Generate disposable random material, a nonce or PKCE-related value, and a request/session correlation ID for the test run. Validate the UUID shape, keep the original fixture separate from logs, and label every value as test-only before it enters a request or report.
Use jwt-generator to create a synthetic token with deliberate claim variants, then create either a standalone OTP or an RFC-style TOTP/HOTP value from a disposable test seed. Keep the expected claims, time step, counter, and code beside the fixture, not in a production log.
Use jwt-decoder to inspect the header and payload and base64url-encoder to check the representation of JWT or PKCE segments. Use jwk-generator only for a synthetic key or an authorized public JWK, comparing fields such as kid and algorithm without importing a private key.
Use secure-random-generator, nonce-generator, and uuid-generator to create fresh test material. If you already have an authorized capture, preserve only the minimum sanitized value needed for analysis and never replace decoding with a claim that the token is trustworthy.
Choose otp-generator for a standalone numeric code such as an email or SMS fixture. Choose totp-hotp-offline-generator when a shared Base32 seed, time step, or counter is part of an authenticator-style test; use only a disposable test seed.
jwt-decoder and base64url-encoder explain structure and encoding only. hmac-generator-verifier and the supported checks in jwt-decoder-security-auditor test a known expected signature or claim condition. Treat the final security review as a separate audit of algorithm, expiry, sensitive claims, and evidence handling.
For the disposable fixture, use hmac-generator-verifier to compare a known message and test secret, and use jwt-decoder-security-auditor for its supported HS256 or RS256 signature and expiry checks. Re-run TOTP or HOTP with the recorded time or counter when timing drift is the suspected failure; a matching local value still does not prove a server accepted it.
Perform a separate review of algorithm choice, expiry and not-before behavior, sensitive claims, code-window assumptions, and traceability. Store only sanitized metadata, pass/fail outcomes, fingerprints or redacted excerpts, the correlation ID, residual uncertainty, and the authorized next action; discard raw secrets and live session material.