Encoding & Crypto

Compute MD5 / SHA-1 / SHA-256 / SHA-384 / SHA-512 hashes, all five at once, browser-only

Triage a mixed batch locally for file type mismatches, duplicate candidates, metadata privacy, archive risks, and next-step tools.

Compute SHA-1, SHA-256, SHA-384, or SHA-512 hashes for uploaded files entirely in the browser.

Paste an expected checksum, upload a file, and verify SHA digest matches locally before installing or sharing.

Upload a batch and find exact duplicate files by SHA hash locally, with a Markdown cleanup report.

bcrypt password hash generator + verifier — pick rounds, hash and compare in browser.

Decode JWT header / payload / signature — verify structure, check exp, copy claims — browser-only

Encode JWT — pick algorithm (HS256/HS384/HS512), set header/payload/secret, get token.

Encrypt & decrypt text with a password — AES-256-GCM + PBKDF2 via WebCrypto — 100% in your browser, nothing uploaded

HMAC-SHA1/256/384/512 — message + secret key, output in hex and base64, key read as UTF-8/hex/base64 — 100% in-browser

Generate strong, cryptographically random passwords and passphrases — entirely in your browser.

Check password strength — entropy, time-to-crack, breach pattern check (offline).

Password leak checker — check if your password has been seen in known breaches using k-anonymity (HIBP API style), the password never leaves your browser.

Cryptographically secure word-based passphrases — pick word count, separator, casing; live entropy; 100% in-browser, never in the URL.

Encode or decode Base64 — text, files, and Data URLs. Runs entirely in your browser.

Image ⇄ Base64 — drag-drop PNG/JPG/WebP/SVG, get data URI for CSS / HTML / Markdown.

Upload a small file and convert it to raw Base64 or a data URL locally for embeds, fixtures, and tests.

Paste raw Base64 or a data URL, decode it locally, inspect bytes, and download the reconstructed file.

Encode and decode URL-unsafe characters — query strings, path segments, full URLs — instant, browser-only

Encode/decode HTML entities — & < > " ' and all numeric refs — browser-only

ROT13 / ROT47 / Caesar cipher — encode and decode in your browser, instant.

Text to binary (and back) — UTF-8 aware, 8/16/32 bit grouping, emoji safe.

Generate QR codes from text, URL, WiFi or vCard — customize color and size, download as PNG or SVG.

Encrypt and decrypt the ax+b affine cipher with live modular-inverse check, browser-only

Mirror the alphabet, A↔Z B↔Y, no key, self-reciprocal so the same button encodes and decodes, browser-only

Turn text into five-letter A/B groups, or read a Baconian message back — 24 and 26 letter alphabets, custom symbols, browser only

Turn big integers and UTF-8 text into compact 0-9A-Za-z strings, the way short-URL services pack an ID into 6 characters, all in your browser

Base64 ⇄ hexadecimal at the byte level, no text encoding in between — standard or URL-safe, your separator and case, runs in your browser

Encode and decode URL-safe Base64 strings for JWT headers, payloads, tokens, and URL parameters without padding surprises.

Encode text to Ascii85 or Z85 and decode it back, UTF-8 safe, with z-compression and <~ ~> handling, all in your browser

C = (key − text) mod 26, reciprocal — one keyword both encrypts and decrypts — browser-only

Encrypt, decrypt and brute-force a Caesar shift cipher — all 25 shifts at once, ROT13 shortcut, browser-only

Keyword sets the column order, the grid does the scrambling — encrypt, decrypt, regular or irregular padding, all in your browser

Encrypt and decrypt with a 5x5 keyword square, digraph pairs and a live grid, browser-only

Turn letters into 5x5 grid coordinates and back, with a keyword square, origin switch and a live grid, browser-only

Unicode ⇄ Punycode for internationalized domains — münchen.de ⇄ xn--mnchen-3ya.de — per-label, email-aware, browser-only

Quoted-Printable encode and decode by UTF-8 bytes, the way email MIME does it, with =XX escapes, trailing-space handling and 76-column soft wraps, all in your browser

Encrypt, decrypt and brute-force a rail fence zigzag cipher, with a live grid, rail count plus offset, browser-only

Rotate all visible ASCII by 47. Digits and symbols change too, fully self-inverse, runs in your browser.

Encrypt and decrypt the ancient Spartan scytale rod cipher, with a live rod grid and an adjustable diameter, browser-only

Knock cipher on a 5×5 grid, C and K share a cell, row taps then column taps, decode back to text, all in your browser

Text ⇄ hexadecimal by UTF-8 bytes — Chinese and emoji safe, picks your separator and case, decodes messy pasted hex — runs in your browser

Text ⇄ Unicode escapes — \uXXXX, \u{1F600}, &#128512;, CSS \1F600 — emoji + CJK done right, browser-only

Encode, decode, inspect query parameters, process bulk URL lists, and copy clean outputs entirely in your browser.

Paste a URL, see every parameter decoded in a table; edit the rows and get a clean, correctly-encoded query string back — %20 or +, sorted or not, in your browser

Encrypt and decrypt with a keyword, polyalphabetic shift, case kept, non-letters passed through, browser-only

Base32 + Base58 encoder/decoder — RFC 4648 base32 (Crockford variant too), Bitcoin base58, Solana base58, hex/text/file input.

Find duplicates and keep one clean copy of base64 blocks from pasted text or uploaded local files.

Extract, dedupe, and export base64 blocks from pasted text or uploaded local files.

Convert base64 blocks from pasted text or uploaded local files.

Validate and explain issues in base64 blocks from pasted text or uploaded local files.

Normalize, sort, and prepare base64 blocks from pasted text or uploaded local files.

Convert images to data URIs (base64 or URL-encoded), inspect any data URI, preview and download. 100% in-browser.

Username plus password into Authorization Basic base64, with curl -u and -H examples, plus reverse decoding, all in your browser

Decode JWT headers and payloads locally, inspect registered claims, timing, audience and risk signals.

Standard CRC-32 (IEEE) of any text in hex and unsigned decimal, with optional CRC32C, computed in your browser

Find duplicates and keep one clean copy of credit card numbers from pasted text or uploaded local files.

Extract, dedupe, and export credit card numbers from pasted text or uploaded local files.

Convert credit card numbers from pasted text or uploaded local files.

Validate and explain issues in credit card numbers from pasted text or uploaded local files.

Normalize, sort, and prepare credit card numbers from pasted text or uploaded local files.

Inspect Content-Security-Policy directives for unsafe sources, missing fallbacks, framing gaps, object-src, base-uri, and reporting coverage.

Hide your email from scraper bots — HTML entities, [at]/[dot] text, ROT13+JS link — browser-only, one-click copy

Scan .env files, config snippets, and CI logs locally for likely API keys, tokens, private keys, JWTs, and database URLs.

Paste any hash string and instantly identify MD5, SHA-256, bcrypt, Argon2, and 30+ other formats

Offset, hex bytes and ASCII side by side, the classic xxd / hexdump -C layout, fully in your browser

Encode & decode all HTML5 entities — named, decimal, hex — XSS prevention and safe markup, 100% client-side

Generate Apache/Nginx .htpasswd lines — bcrypt, apr1 (MD5), SHA-1 — multi-user, copy, download — 100% browser-only

Audit raw response headers for HSTS, CSP, cookie flags, MIME sniffing, clickjacking, referrer, and permissions policy gaps.

Scan uploaded images for EXIF, GPS, camera, software, dates, XMP, and ICC privacy indicators.

Escape and unescape strings for JSON, regex literals, and template literals — browser-only, instant output

Escape raw text into JSON string content or a quoted JSON string literal, and decode escaped JSON strings back to readable text in your browser.

Find duplicates and keep one clean copy of jwt tokens from pasted text or uploaded local files.

Extract, dedupe, and export jwt tokens from pasted text or uploaded local files.

Convert jwt tokens from pasted text or uploaded local files.

Validate and explain issues in jwt tokens from pasted text or uploaded local files.

Normalize, sort, and prepare jwt tokens from pasted text or uploaded local files.

Find duplicates and keep one clean copy of mac addresses from pasted text or uploaded local files.

Extract, dedupe, and export mac addresses from pasted text or uploaded local files.

Convert mac addresses from pasted text or uploaded local files.

Validate and explain issues in mac addresses from pasted text or uploaded local files.

Normalize, sort, and prepare mac addresses from pasted text or uploaded local files.

OAuth 2.0 scope reference — 60+ scopes across Google, GitHub, Microsoft, Slack, Spotify, Discord and more, with access level, use cases and risk rating.

Inspect package-lock.json, pnpm-lock.yaml, or yarn.lock for duplicate versions, risky sources, prereleases, and missing integrity.

Drop a folder of QR images and get every decoded URL in one table — fast batch audit for packaging, posters, and print runs.

Paste once — see escaped strings for JSON, Python, Go, C#, Rust, Java, C, Ruby, PHP, Swift, Kotlin & JS side by side

Escape & unescape strings for JSON, JS, Java, C, SQL, Shell, HTML, CSV & regex — both directions — browser-only

Inspect any character — code point, UTF-8 bytes, UTF-16 encoding, Unicode category, script, and block — instant, browser-only

Inspect code points, names, categories, UTF-8 bytes and normalize text to NFC, NFD, NFKC or NFKD entirely in your browser.

Find duplicates and keep one clean copy of uuids from pasted text or uploaded local files.

Extract, dedupe, and export uuids from pasted text or uploaded local files.

Convert uuids from pasted text or uploaded local files.

Validate and explain issues in uuids from pasted text or uploaded local files.

Normalize, sort, and prepare uuids from pasted text or uploaded local files.

Read a ZIP central directory locally and flag traversal paths, encryption, duplicate names, and risky ratios.