Encoding & Crypto
Encode, decode, hash, and generate secrets. 21 tools
Encoding makes data survive a journey through systems that only accept text — URLs, JSON payloads, HTTP headers, HTML attributes. Hashing does the opposite job, producing a fixed fingerprint you cannot reverse. These tools cover both, plus the generators for passwords, UUIDs and keys.
Worth being clear on one distinction: Base64 and URL encoding are reversible and protect nothing, while hashes are one-way. If you are trying to hide something, neither is encryption.
All 21 encoding & crypto
JSON String Escape
Escape text to one JSON string or strictly decode it, preserving embedded text and numeric IDs.
Base64 Encoder & Decoder
Encode and decode text or files with Base64, Base64URL, data URI detection, preview and download.
URL Encode/Decode
Encode or decode URL components, full URLs and form values with correct %20, + and %2B handling.
HTML Entity Encode/Decode
Encode or decode HTML entities using named, decimal or hex forms, including the full HTML5 entity set.
Hash Generator
Hash text or hex bytes with SHA algorithms, compare an expected digest and download results.
JWT Decoder
Decode JWT claims with exact numbers and expiry times, without verifying the signature.
UUID Generator
Generate 1 to 100 random version-4 UUIDs at once, using your device's cryptographic randomness.
Password Generator
Generate strong, random passwords with custom rules.
Hex / Binary / Text Converter
Convert UTF-8 text, hex and binary in six directions, validate input and download original bytes.
Morse Code Translator
Convert text to Morse code and back, with audio playback.
Caesar Cipher / ROT13
Encrypt or decrypt text with a shift cipher, including ROT13.
HMAC Generator
Generate and verify HMAC digests with five algorithms and hex, Base64 or Base64URL output.
File Hash Checker
Get SHA-1, SHA-256 and SHA-512 checksums for a file, then paste the expected value to confirm a match.
Unicode Escape/Unescape
Turn text into \uXXXX sequences and back; by default only non-ASCII goes, or tick Escape everything.
Base32 Encode/Decode
Encode UTF-8 text or hex bytes as RFC 4648 Base32; strictly decode and download exact bytes.
File to Base64
Encode files locally as Base64 or data URLs, compare SHA-256 and download the full text.
Base64 to File
Decode Base64 to a file locally, inspect byte headers and verify the SHA-256 fingerprint.
Base64 to Image
Validate Base64 image bytes and dimensions, then preview and download the original file.
Base64 ⇄ Hex
Convert Base64, Base64URL and hex with strict validation, exact byte counts and downloads.
Text Encrypt / Decrypt
Encrypt text as AES-256-GCM JSON, detect changed messages on decrypt and recover older CryptoJS text.
Text Encoding Converter
Decode supported text encodings and save UTF-8 or UTF-16 with strict byte checks and BOM options.
What to know before you pick one
Encoding is not encryption, and hashing is neither
These three get confused constantly and the difference matters. Encoding rewrites data so it survives a journey through systems that only accept plain text — anyone can reverse it, and it protects nothing. Hashing produces a fixed-length fingerprint that cannot be turned back into the original at all. Encryption is the only one of the three that hides something, and none of the tools on this page do it. If you Base64 a password to keep it secret, it is not secret.
Why Base64 makes files bigger
Base64 represents every three bytes using four characters, so anything encoded this way grows by roughly a third. That is the price of being safe to paste into JSON, an email header or a data URL. It is worth knowing before embedding a large image into a stylesheet or a payload: the file you send is meaningfully larger than the file you started with.
URL encoding depends on where in the URL you are
The same character is legal in one part of a URL and must be escaped in another. A slash is meaningful in a path and merely data in a query string; a plus sign means a space in a query and means a plus in a path. This is why a link can work when typed and break when built by joining strings together, and why encoding the whole URL at once usually produces something worse than encoding each part.
A hash tells you two files differ, not how
Change one byte and the entire hash changes, which is exactly what makes it useful for verifying that a download arrived intact or that a value has not been altered. It also means a hash can never tell you what changed or by how much. For that you want a difference check on the content itself.
What makes a generated password actually strong
Length does more work than complexity. A long passphrase of ordinary words is harder to attack than a short string of symbols, and far easier to type correctly. The generators here run in your browser using the operating system’s own source of randomness, so nothing generated is transmitted or stored — which matters, because a password that has travelled over a network to reach you has already had a life you cannot audit.