How to Improve Website Security
Practical security improvements using free browser tools — JWT verification, secret generation, and access control configuration.
Overview
Website security requires attention at multiple layers: authentication (JWT tokens, session management), access control (robots.txt, headers), and secret management (API keys, signing secrets).
The JWT Decoder helps you verify that your tokens contain the correct claims and haven't expired — without needing to write code. The Secret Generator produces cryptographically random API keys, JWT secrets, and passwords using browser-native cryptography.
The Robots.txt Generator helps configure which areas of your site are accessible to search engine crawlers, limiting exposure of admin panels and sensitive paths. The Base64 tool helps inspect encoded credentials and tokens.
Step-by-Step Guides
- 1Copy the JWT token from your auth system or API response.
- 2Open the JWT Decoder and paste the token.
- 3Check the algorithm in the header — avoid "alg: none" which is insecure.
- 4Verify the exp (expiry) claim is set and not too far in the future.
- 1Open the Secret Generator.
- 2Set length to 32 for API keys, 64 for HMAC/JWT signing secrets.
- 3Choose hexadecimal or alphanumeric character set.
- 4Click Generate — a new random key is created each time.
- 5Copy immediately and store in your environment variables.
- 1Open the Robots.txt Generator.
- 2Add Disallow rules for /admin, /wp-admin, /dashboard, and any other sensitive paths.
- 3Note: robots.txt is not a security control — it only affects crawlers, not attackers.
- 4Also implement proper authentication and IP restrictions for admin pages.
Recommended Tools
Frequently Asked Questions
Is robots.txt a security measure?
No. robots.txt only asks well-behaved crawlers not to index certain pages. Attackers ignore it. Use proper authentication for truly sensitive pages.
How long should a JWT token last?
Access tokens: 15 minutes to 1 hour. Refresh tokens: 7-30 days. Short lifetimes limit damage if a token is compromised.
What makes a good API key?
Cryptographically random, at least 32 characters, stored securely (never in source code), rotated regularly. The Secret Generator creates keys meeting these criteria.
Should I use the "none" JWT algorithm?
Never. The "alg: none" JWT algorithm disables signature verification entirely. Always use HS256 or RS256 minimum.