Web Crypto API Capabilities Inspector
Checks this browser context and attempts four Web Crypto operations: SHA-256, AES-GCM, HMAC-SHA-256, and ECDSA P-256. Results describe this context only.
About this web crypto api capabilities inspector
Checks this browser context and attempts four Web Crypto operations: SHA-256, AES-GCM, HMAC-SHA-256, and ECDSA P-256. Results describe this context only Runs entirely in-memory using Web Crypto primitives to keep sensitive tokens, certificates, and cryptographic keys secure from third-party interception.
Encoding & cryptographic principles
Tests whether the current secure context exposes Web Crypto and attempts SHA-256, AES-GCM, HMAC-SHA-256, and ECDSA P-256 operations. It reports browser API availability, not hardware backing or application security.
Worked verification example
Scenario: Probe the four Web Crypto operations exposed by the current page context.
Sample input:
Processing: Check secure context and random APIs, then attempt SHA-256, AES-GCM, HMAC and ECDSA P-256 operations.
Illustrative output:
Security parameters & input constraints
Algorithm checks run only when crypto.subtle is present; otherwise the testedAlgorithms object is empty. A successful attempt shows this operation worked now, not hardware backing, safe key handling, permission for other APIs or application security. secureContext can be null outside a browser.
Cryptographic digests, encoded strings, and signatures generated by Web Crypto API Capabilities Inspector should be verified against target authentication systems before production use.
Client-side Web Crypto boundary
Key derivation, hashing, and encoding in Web Crypto API Capabilities Inspector execute in local memory using Web Crypto APIs without remote socket transmission.
Cryptographic specifications & RFC standards
Technical specifications and cryptographic RFC standards governing algorithms and key representations:
Web Crypto API Capabilities Inspector verification · Audit standards
How to use it
- Run the inspector in the current browser; the input text is ignored.
- Check secure-context and Web Crypto availability, then attempt SHA-256 digest plus AES-GCM, HMAC-SHA-256 and ECDSA P-256 key generation where subtle crypto exists.
- Read per-algorithm Boolean results and availability flags in JSON.
Frequently asked questions
What does Web Crypto Inspector test?+
It reports secure-context status, availability of crypto.subtle and crypto.getRandomValues, then attempts SHA-256 digest, AES-GCM key generation, HMAC key generation, and ECDSA P-256 key generation.
What example can I run locally?+
In a secure local page context, run the probe and check that secureContext, subtleCryptoAvailable and randomValuesAvailable are true. The page then reports whether its SHA-256, AES-GCM, HMAC and ECDSA P-256 attempts succeed in your current browser.
Does available mean every Web Crypto operation works?+
No. This is a small capability probe. It does not test every algorithm, key import/export format, browser policy, hardware-backed key, quota, cipher vector, or failure mode.
Can this diagnose a remote site?+
No. It inspects the current page context only. Headers, origin trust, enterprise policy, extensions, secure transport and another browser can produce different capability results.