🧰 Encoder & Hash Toolkit
Base64, URL encoding, and MD5/SHA hashes — all computed locally in your browser.
What does this toolkit do?
This page bundles three jobs developers and sysadmins do constantly: Base64 encoding/decoding, URL encoding/decoding, and hash generation (MD5, SHA-1, SHA-256, SHA-512). Everything is computed in your browser using native APIs — your input is never uploaded.
When to use each
- Base64 — encode binary or text data into a safe ASCII string, common in data URIs, email attachments, and config files.
- URL encoding — escape special characters so they can travel safely inside a URL or query string.
- SHA-256 / SHA-512 — verify file integrity and checksums; modern, secure hashing.
- MD5 / SHA-1 — still widely used for checksums and legacy systems, but not secure for passwords or signatures.
A note on security
Hashing is not encryption — it's one-way. Never use MD5 or SHA-1 to protect passwords; use a purpose-built password hash on the server instead. For account security, generate strong unique passwords with our password generator.
Frequently asked questions
Is MD5 still safe to use?
Not for security. MD5 and SHA-1 are considered broken because attackers can engineer collisions, so they must never protect passwords, signatures, or certificates. They're still perfectly fine for non-security tasks like verifying a file downloaded correctly (a checksum). For anything security related, use SHA-256 or SHA-512.
What's the difference between hashing and encryption?
Hashing is one-way: you can turn data into a fixed-length digest, but you can't reverse the digest back into the original. Encryption is two-way: with the right key, ciphertext can be decrypted back to the original. Base64 is neither — it's just reversible encoding, not protection.
Is my input uploaded anywhere?
No. All hashing and encoding runs entirely in your browser using native APIs. Your text never leaves your device, which makes this safe to use even for sensitive strings.
What is Base64 actually for?
Base64 converts binary or text data into a compact ASCII string that survives systems which only handle plain text — think data URIs for images, email attachments, JWT tokens, and config files. It does not compress or secure data; it only makes it safe to transport.