Base64, URL & Hash Tool
Encode or decode Base64, URL, and HTML entities, and generate MD5/SHA hashes — all locally in your browser, nothing sent anywhere.
By Alex van den Berg · Last reviewed · How we test our tools
What each mode is for
Base64
Embedding binary data (images, files) as text in JSON, data URLs, or Basic Auth headers.
URL encoding
Safely putting spaces, symbols, and unicode text inside a query string or URL path.
HTML entities
Displaying raw <, &, and quotes safely inside HTML markup.
Hashing
Verifying file integrity, generating cache keys, or comparing two pieces of text for equality without storing them.
Nothing leaves your browser
Base64, URL, and HTML conversions are pure JavaScript string operations. Hashes are computed with the browser's built-in Web Crypto API for SHA-1/256/384/512, and a local JavaScript implementation for MD5 (which Web Crypto doesn't expose). None of it touches a network request — which matters if you're hashing or encoding something sensitive like an API key, token, or password reset link.
Frequently Asked Questions
Is my text sent anywhere?
No. Every encoding, decoding, and hash calculation happens locally in your browser using JavaScript and the Web Crypto API. Nothing is transmitted to a server, which makes this safe for API keys, tokens, and other sensitive strings.
What is Base64 actually for?
Base64 turns arbitrary binary data into plain ASCII text using 64 printable characters, so it can safely travel through systems that only handle text — email attachments, JSON payloads, data URLs, and HTTP Basic Auth headers. It is an encoding, not encryption, and offers no confidentiality.
Why does decoding my Base64 text fail?
Valid Base64 only contains letters, digits, +, /, and = padding. If the text was copied with line breaks, URL-safe substitutions (- and _ instead of + and /), or simply isn't Base64, decoding will fail. Strip whitespace and check for URL-safe variants first.
Should I use MD5 for passwords?
No. MD5 and even SHA-256 are fast general-purpose hash functions, not password hashes — they can be brute-forced or looked up in rainbow tables far too quickly. Passwords should use a dedicated slow algorithm like bcrypt, scrypt, or Argon2. This tool is for checksums, cache keys, and data integrity checks, not credential storage.
What's the difference between URL encoding and Base64?
URL encoding (percent-encoding) escapes characters that aren't safe in a URL, like spaces and &, using %XX sequences — the text stays mostly readable. Base64 re-encodes the entire input into a different, denser alphabet and is used for embedding binary or arbitrary data, not specifically for URLs.