Encode, decode, and hash without leaving the tab
Encode and decode: Base64 encode / Base64 decode, URL encode (percent-encoding, `encodeURIComponent`), HTML encode (entities), plus MD5 and SHA-256 hashes. Encoding is transport. Hashing is one-way. Neither is encryption.
Why people Base64-encode (and why it is not a lock)
JSON, email, and data URLs want ASCII-safe bytes. `Hello` ↔ `SGVsbG8=` is a costume — anyone decodes it. Do not hide an API key in a frontend bundle and call it Base64 “encryption.” Image to Base64 is a data URL for a tiny icon in CSS, not a way to compress a PNG. Minify SVG if the icon is already vectors.
URL encode the query parts that are illegal: spaces, `&`, `=`. `hello world` → `hello%20world`. Encoding a whole `https://` with `encodeURIComponent` breaks the URL. HTML encode turns `<script>` into `<script>` when the text will sit in a page — that habit is the difference between a demo and an XSS report.
Hashes: MD5 vs SHA-256
MD5 is still used as a casual checksum of a non-hostile file. For integrity on anything that matters, SHA-256 is the boring default. Never roll a password scheme from MD5. A JWT payload is encoded JSON you can read; a SHA-256 digest is not reversible. If someone can read the output without a key, it was never a secret.
Tools in this hub
Base64 Encode
Encode text to Base64 online. UTF-8 aware. Pair with Base64 decode when you need the original back.
Base64 Decode
Decode Base64 to text online. Handles standard padded strings from APIs and data URIs.
URL Encode
URL encode online. Percent-encode query strings and path segments the way browsers expect.
URL Decode
URL decode online. Turn percent-encoded strings back into readable text.
HTML Encode
HTML-encode special characters to entities. Safer snippets for docs and CMS fields.
HTML Decode
Decode HTML entities to characters. Reverse & < > " and numeric entities.
JavaScript String Escape
Escape a string for JavaScript quotes. Backslashes, quotes, and control characters handled.
Unicode Escape
Escape non-ASCII characters to \uXXXX sequences for JS and JSON-adjacent payloads.
MD5 Hash Generator
Generate an MD5 hash online. For checksums and legacy systems — not for passwords.
SHA-256 Hash Generator
Generate a SHA-256 hash online. UTF-8 input, hex output. Browser Web Crypto or PHP fallback.
Hash Generator
Generate MD5, SHA-1, and SHA-256 hashes from one input. Compare checksums without installing a CLI.
Image to Base64
Convert images to Base64 data URLs in the browser. PNG, JPEG, GIF, WebP, and SVG for CSS and HTML embeds.
Questions about encode & hash
Is Base64 encryption?
No. Anyone can decode it. WebBeautify ↔ V2ViQmVhdXRpZnk= is a costume. Use Base64 for binary-in-text — JSON, data URLs, email — not for hiding an API key in a frontend bundle.
URL encode versus encoding a whole URL?
Percent-encode the parts that are illegal in a query: spaces, &, =, non-ASCII. hello world becomes hello%20world. Do not blindly encode https:// or you break the URL. Think encodeURIComponent, not “smash the whole string.”
HTML encode — when do I need it?
When text might contain < or & and you will put it in HTML. <script> as text should become <script>. Fun fact: that one habit is the difference between a demo and an XSS report.
Should I still use MD5?
For a casual checksum of a non-hostile file, people still do. For security, use SHA-256 or better. Never roll a password scheme from MD5. Hashing is one-way; encoding is not.
What is Unicode escape for?
Pipelines that want \uXXXX instead of raw UTF-8. München can stay as letters or become M\u00fcnchen. Both can be valid in JSON. UTF-8 is nicer to read; escapes are nicer for some old pipes.
Image to Base64 — is that compression?
Opposite mood. A data URL is the image bytes plus overhead, stuffed into text. Useful for a tiny icon in CSS. Terrible as a “make the PNG smaller” plan. Minify SVG if the icon is already vectors.
JWT payload versus a hash?
JWT claims are encoded JSON — readable. A SHA-256 digest is not reversible. If someone can read the output without a key, it was never a secret. Encryption needs a key you do not paste into a bundle.
Why does SHA-1 still show up?
Legacy checksums still exist in the wild. Compare them, do not design a new protocol on SHA-1. SHA-256 is the boring grown-up default for integrity.