Base64 encoder / decoder
Encode Unicode text as Base64 or decode it, with URL-safe options and an interactive byte preview.
← All tools
Developer utilities
Encodings and identifiers, decoded and explained.
Hash file
Calculate a local SHA-256, SHA-384, or SHA-512 fingerprint of any file and compare an expected checksum.
Hash text
Create SHA-256, SHA-384, or SHA-512 checksums from exact UTF-8 text and compare with an expected digest.
HTML entity encoder / decoder
Escape HTML special characters or decode named and numeric references as safe plain text, with a live preview.
JWT decoder
Inspect JWT header and payload JSON, timestamps, and signature size with a clear unverified-token status.
Number base converter
Convert exact whole numbers between bases 2–36 with live binary, octal, decimal, and hexadecimal comparisons.
Password generator
Create random passwords with deliberate length and character controls, multiple outputs, and local copy or download.
Text to binary
Convert UTF-8 text to binary byte groups and back, with live output and a byte-by-byte hexadecimal inspector.
URL encoder / decoder
Encode or decode URL components, whole URLs, and form values with direction controls and live output.
UUID generator
Generate random version 4 UUIDs on your device, with batch count, hyphen, uppercase, copy, and download controls.
Base64, URL encoding, HTML entities, binary, number bases, hashes, UUIDs, passwords, and JWTs. The tools show the bytes underneath so you can see why two representations differ.
Decoding is not verification: tokens, hashes, and checksums are only reported for what they are, never treated as proof of trust.
Encoding, hashing, and randomness
Three different jobs share this category. Encodings such as Base64, URL encoding, HTML entities, binary, and number bases change how data is represented without hiding it, and anyone can reverse them. Hashes such as SHA-256 create a fixed-size fingerprint of text or a file that changes completely if a single byte changes, which is how you check that a download or a message is intact. Generators create passwords and UUIDs from the browser's cryptographic random source.
The JWT decoder sits in between: it decodes the header and payload of a token so you can read its claims and expiry dates, but it deliberately does not verify the signature.
Common mix-ups
Encoding is not encryption: a Base64 string is as readable as plain text to anyone who decodes it. Hashing is not encryption either: it cannot be reversed, but fast hashes like SHA-256 are unsuitable for storing passwords, which need slow, salted algorithms such as Argon2 or bcrypt. Decoding a JWT is not validating it: claims mean nothing until the signature is checked with the issuer's key.
Most encoding bugs come from applying the wrong scheme or applying one twice. Examples are URL-encoding a whole URL instead of a single parameter, decoding URL-safe Base64 as standard Base64, or HTML-escaping text that is already escaped. The tools show the bytes involved so you can see exactly where two representations differ.