Encoding & Security

Base64 / URL / Hash / Encrypt · 15 tools

These tools deal with three different things that are routinely confused with each other: encoding (reversible, no key), hashing (one-way, no key) and encryption (reversible, needs a key). Base64, URL encoding, Base32, Unicode escapes and HTML entities are encoding — anyone can turn them back. MD5, SHA and CRC32 are digests — you cannot reverse them, you can only compare. HMAC is a digest bound to a secret key. None of the tools on this page encrypt anything.

Everything runs in your browser. That matters more here than on other pages: keys, JWTs and passwords you paste in are never sent to a server.

Which one do I need?

Moving data safely through a text channel (URL parameter, JSON string, email header): Base64 or URL encoding. Choose Base32 when the target is case-insensitive or human-transcribed.
Checking whether a file or payload changed: SHA-256, or CRC32 if you only need to catch accidental corruption. CRC32 is linear, so it cannot detect deliberate tampering.
Signing an API request: HMAC with a shared secret. Remember both sides can produce the signature, so it proves integrity, not authorship.
Looking inside a token: the JWT decoder splits the three parts and shows the payload. Decoding is not verification — the signature still has to be checked with the key.
Generating identifiers or passwords: UUID and Password generators both draw from the platform CSPRNG, not from Math.random.

All tools in this category

Base64 Encode / DecodeHOT Convert text to Base64 or decode Base64 back to text, with full support for Chinese and emoji URL Encode / Decode Percent-encoding conversion for Chinese parameters and special characters Unicode Encode / Decode Convert between text and \uXXXX escape sequences UTF-8 Encode / Decode Convert between text and UTF-8 hex bytes Escape Encode / Decode Convert between URL percent-encoding and escape sequences MD5 Hash GeneratorHOT Compute the 32-character MD5 hash of text, with batch and case-toggle support SHA Hash Generator Compute SHA-1 / SHA-256 / SHA-384 / SHA-512 in one click HMAC Signature Compute an HMAC-SHA signature with a secret key, handy for API debugging CRC32 Checksum Compute the CRC32 checksum, commonly used for data verification Base32 Encode / Decode RFC 4648 Base32 encoding, often used for Google Authenticator keys JWT ParserHOT Parse the JWT header and payload, and check the expiry time UUID Generator Generate v4 random UUIDs in bulk, with formatting options Password GeneratorHOT Generate strong random passwords with a customizable character set and length Morse Code Converter Convert text to Morse code (.-) and back, supports Latin characters Hash Compare Compare a text hash against a given value to verify a downloaded file

Guides in this category

FAQ

Is Base64 a form of encryption?

No. It has no key and is fully reversible — the 64-character alphabet is public. It exists to carry binary data through channels that only accept text. If you need secrecy, use actual encryption.

Can I still use MD5 or SHA-1?

For non-adversarial integrity checks, yes — they are fast and widely supported. For signatures, certificates or password storage, no: practical collision attacks against both are public, so an attacker can craft a second input with the same digest.

Can a hash be reversed?

Not mathematically. But short or predictable inputs (common passwords, 4-digit PINs, dictionary words) can be looked up in precomputed tables. That is why password storage needs a random salt and a deliberately slow algorithm such as bcrypt, scrypt or Argon2 — and why MD5 over a password is unsafe even today.