Encoding & Crypto

Compute MD5 / SHA-1 / SHA-256 / SHA-384 / SHA-512 hashes — all five at once, browser-only

Triage a mixed batch locally for file type mismatches, duplicate candidates, metadata privacy, archive risks, and next-step tools.

Compute SHA-1, SHA-256, SHA-384, or SHA-512 hashes for uploaded files entirely in the browser.

Paste an expected checksum, upload a file, and verify SHA digest matches locally before installing or sharing.

Upload a batch and find exact duplicate files by SHA hash locally, with a Markdown cleanup report.

bcrypt password hash generator + verifier — pick rounds, hash and compare in browser.

Decode JWT header / payload / signature — verify structure, check exp, copy claims — browser-only

Encode JWT — pick algorithm (HS256/HS384/HS512), set header/payload/secret, get token.

Generate strong, cryptographically random passwords and passphrases — entirely in your browser.

Check password strength — entropy, time-to-crack, breach pattern check (offline).

Password leak checker — check if your password has been seen in known breaches using k-anonymity (HIBP API style), the password never leaves your browser.

Encode or decode Base64 — text, files, and Data URLs. Runs entirely in your browser.

Image ⇄ Base64 — drag-drop PNG/JPG/WebP/SVG, get data URI for CSS / HTML / Markdown.

Upload a small file and convert it to raw Base64 or a data URL locally for embeds, fixtures, and tests.

Paste raw Base64 or a data URL, decode it locally, inspect bytes, and download the reconstructed file.

Encode and decode URL-unsafe characters — query strings, path segments, full URLs — instant, browser-only

Encode/decode HTML entities — & < > " ' and all numeric refs — browser-only

ROT13 / ROT47 / Caesar cipher — encode and decode in your browser, instant.

Text to binary (and back) — UTF-8 aware, 8/16/32 bit grouping, emoji safe.

Generate QR codes from text, URL, WiFi or vCard — customize color and size, download as PNG or SVG.

Encrypt & decrypt text with a password — AES-256-GCM + PBKDF2 via WebCrypto — 100% in your browser, nothing uploaded

Base32 + Base58 encoder/decoder — RFC 4648 base32 (Crockford variant too), Bitcoin base58, Solana base58, hex/text/file input.

Find duplicates and keep one clean copy of base64 blocks from pasted text or uploaded local files.

Extract, dedupe, and export base64 blocks from pasted text or uploaded local files.

Convert base64 blocks from pasted text or uploaded local files.

Validate and explain issues in base64 blocks from pasted text or uploaded local files.

Normalize, sort, and prepare base64 blocks from pasted text or uploaded local files.

Base64 ⇄ hexadecimal at the byte level, no text encoding in between — standard or URL-safe, your separator and case, runs in your browser

Encode text to Ascii85 or Z85 and decode it back, UTF-8 safe, with z-compression and <~ ~> handling, all in your browser

Encrypt, decrypt and brute-force a Caesar shift cipher — all 25 shifts at once, ROT13 shortcut, browser-only

Find duplicates and keep one clean copy of credit card numbers from pasted text or uploaded local files.

Extract, dedupe, and export credit card numbers from pasted text or uploaded local files.

Convert credit card numbers from pasted text or uploaded local files.

Validate and explain issues in credit card numbers from pasted text or uploaded local files.

Normalize, sort, and prepare credit card numbers from pasted text or uploaded local files.

Inspect Content-Security-Policy directives for unsafe sources, missing fallbacks, framing gaps, object-src, base-uri, and reporting coverage.

Cryptographically secure word-based passphrases — pick word count, separator, casing; live entropy; 100% in-browser, never in the URL.

Hide your email from scraper bots — HTML entities, [at]/[dot] text, ROT13+JS link — browser-only, one-click copy

Scan .env files, config snippets, and CI logs locally for likely API keys, tokens, private keys, JWTs, and database URLs.

Offset, hex bytes and ASCII side by side, the classic xxd / hexdump -C layout, fully in your browser

HMAC-SHA1/256/384/512 — message + secret key, output in hex and base64, key read as UTF-8/hex/base64 — 100% in-browser

Generate Apache/Nginx .htpasswd lines — bcrypt, apr1 (MD5), SHA-1 — multi-user, copy, download — 100% browser-only

Audit raw response headers for HSTS, CSP, cookie flags, MIME sniffing, clickjacking, referrer, and permissions policy gaps.

Scan uploaded images for EXIF, GPS, camera, software, dates, XMP, and ICC privacy indicators.

Find duplicates and keep one clean copy of jwt tokens from pasted text or uploaded local files.

Extract, dedupe, and export jwt tokens from pasted text or uploaded local files.

Convert jwt tokens from pasted text or uploaded local files.

Validate and explain issues in jwt tokens from pasted text or uploaded local files.

Normalize, sort, and prepare jwt tokens from pasted text or uploaded local files.

Find duplicates and keep one clean copy of mac addresses from pasted text or uploaded local files.

Extract, dedupe, and export mac addresses from pasted text or uploaded local files.

Convert mac addresses from pasted text or uploaded local files.

Validate and explain issues in mac addresses from pasted text or uploaded local files.

Normalize, sort, and prepare mac addresses from pasted text or uploaded local files.

Inspect package-lock.json, pnpm-lock.yaml, or yarn.lock for duplicate versions, risky sources, prereleases, and missing integrity.

Unicode ⇄ Punycode for internationalized domains — münchen.de ⇄ xn--mnchen-3ya.de — per-label, email-aware, browser-only

Drop a folder of QR images and get every decoded URL in one table — fast batch audit for packaging, posters, and print runs.

Encrypt, decrypt and brute-force a rail fence zigzag cipher, with a live grid, rail count plus offset, browser-only

Escape & unescape strings for JSON, JS, Java, C, SQL, Shell, HTML, CSV & regex — both directions — browser-only

Text ⇄ hexadecimal by UTF-8 bytes — Chinese and emoji safe, picks your separator and case, decodes messy pasted hex — runs in your browser

Text ⇄ Unicode escapes — \uXXXX, \u{1F600}, &#128512;, CSS \1F600 — emoji + CJK done right, browser-only

Find duplicates and keep one clean copy of uuids from pasted text or uploaded local files.

Extract, dedupe, and export uuids from pasted text or uploaded local files.

Convert uuids from pasted text or uploaded local files.

Validate and explain issues in uuids from pasted text or uploaded local files.

Normalize, sort, and prepare uuids from pasted text or uploaded local files.

Encrypt and decrypt with a keyword, polyalphabetic shift, case kept, non-letters passed through, browser-only

Read a ZIP central directory locally and flag traversal paths, encryption, duplicate names, and risky ratios.