Encoder & hash generator
Base64, URL encoding, MD5, SHA-1, SHA-256, SHA-512 and HMAC — fully in your browser.
Text or data to convert. The conversion runs only in your browser.
Optional. Only needed for HMAC-SHA-256: the secret key used to compute the checksum.
How this tool works
The encoder toolkit bundles the five most common codecs in one interface: base64 (standard + URL-safe), URL encoding (percent encoding for query strings), MD5, SHA-1, SHA-256 and SHA-512, plus HMAC. All operations run in your browser via the Web Crypto API — no data transmission, no server logging, no cookies. So it also works for sensitive input like passwords, API keys or token material.
Typical use cases
- Generate file hashes (SHA-256) for integrity checks
- Compute API signatures (HMAC-SHA256) for AWS, Stripe or your own APIs
- Create basic-auth credentials (base64) for a test request
- URL-encode query parameters cleanly (spaces, special chars, umlauts)
- Manually base64-decode JWT header or payload (see also our JWT decoder)
Frequently asked questions
Why is MD5 still included?
MD5 is dead for security (passwords, signatures) — collision-prone. But for data integrity (file checksums, cache keys) it is still widely used. We explicitly mark it as "not for security".
What is URL-safe base64?
Standard base64 uses + and / — both have special meaning in URLs. URL-safe base64 replaces them with - and _ and drops padding (=). Used in JWTs and OAuth codes.
Which hash for password storage?
None of these. For passwords use bcrypt, scrypt or Argon2 — they are deliberately slow and hardened against GPU brute force. SHA-256 is not suitable.
Does HMAC work with binary keys?
Yes — you can input the key as hex or base64. AWS signatures, for example, need binary keys.
Are results stored anywhere?
No. Input, key and result stay in browser memory and disappear when the tab closes.
Related tools
Continuous monitoring vs. one-shot?
XICTRAQ monitors uptime, SSL, security headers, GDPR and performance 24/7. Free plan, no credit card.