Skip to the tool
DevToolBench

Encoding & hashing

Base64, URL and HTML entity encoding, JWT decoding, binary, Morse, number bases and SHA or MD5 hashes, with what each one does and does not protect.

Base64 Encoder and DecoderEncode and decode Base64 with correct UTF-8.Hash GeneratorSHA-1, SHA-256, SHA-384 and SHA-512 digests of any text.HTML Entity Encoder and DecoderEscape and unescape HTML entities safely.Image to Base64 ConverterImage to data URI and back, without uploading the file.JWT DecoderRead a JWT header, payload and expiry safely.MD5 GeneratorMD5 of text or a file, with a checksum comparison.Morse Code TranslatorText to Morse and back, with the whole ITU table on the page.Number Base ConverterAny base from 2 to 36, with BigInt precision.Text to Binary ConverterTurn text into UTF-8 bits, and bits back into text.URL Encoder and DecoderPercent-encode and decode URLs and query values.

Encoding, escaping and hashing get confused because all three turn readable text into something that looks scrambled. They are not interchangeable. Encoding changes how bytes are written so they survive a channel that would otherwise mangle them, and anyone can reverse it. Escaping marks the characters that would otherwise be read as syntax. Hashing is one-way: it produces a fixed-length fingerprint, and nothing gets the input back out of it. Choosing the wrong one is a steady source of both bugs and security holes.

Base64 carries binary data through text-only channels — email attachments, data URIs, tokens — and makes the payload about a third larger. It is not encryption; anyone can decode it. Image to Base64 produces a data URI you can inline in CSS or HTML, which is worth it for a small icon and wasteful for a photograph, since the inlined bytes cannot be cached separately. The URL encoder percent-encodes query values and path segments, and explains why encodeURIComponent and encodeURI give different answers for the same string. The HTML entity encoder escapes <, >, & and quotes, so text shows up as text instead of becoming markup.

The JWT decoder reads the header and payload of a token, which are only Base64url-encoded, and shows when it expires. Decoding is not verifying: until the signature has been checked against the issuer's key, the claims tell you what the token says, not whether to believe it. Text to binary and the number base converter show what sits underneath — the UTF-8 bytes of a string, or a number in any base from 2 to 36, with BigInt so long values keep every digit. The Morse code translator is the same idea in a much older alphabet.

For fingerprints, use the hash generator for SHA-256 or SHA-512, which is what checksums, signatures and content addressing should use today. The MD5 generator exists because MD5 checksums are still published beside many downloads, and comparing one is a legitimate job; MD5 is broken for collision resistance, so it must never protect anything an attacker could forge. Neither tool is a way to store passwords. Those need a deliberately slow algorithm such as Argon2 or bcrypt, with a salt per password.