Base64 & Hash Generator
Encode or decode Base64 strings, or generate a cryptographic hash digest.
Example: The string "hello world" encodes to Base64 as "aGVsbG8gd29ybGQ=" and produces a SHA-256 hash of "b94d27b9934d3e08a52e52d7da7dabfac484efe37a5380ee9088f7ace2efcde" — a fixed-length digest, unchanged even after 5 years, that changes completely if even 1 character of the input changes.
Implements RFC 4648 Base64 encoding and the SHA-2 family of hash functions (SHA-256, SHA-512) per FIPS 180-4.
Base64 vs hashing — what's the difference?
These two tools solve different problems even though they both turn text into other text. Base64 is a reversible encoding — it exists purely to make binary or arbitrary data safe to carry through text-only systems, and decoding it back to the original is trivial and requires no secret. Hashing is one-way: a hash digest is a fixed-length fingerprint of the input, designed so that you can't practically reconstruct the original input from the digest, and even a tiny change to the input produces a completely different hash.
Neither tool is a substitute for encryption or for secure password storage — Base64 provides no confidentiality at all, and general-purpose hash functions like the ones here are deliberately fast, which makes them unsuitable for passwords (a fast hash is easy to brute-force). For anything requiring actual secrecy or password storage, use encryption or a dedicated password-hashing algorithm (bcrypt, scrypt, Argon2) instead.
Frequently asked questions
- What is Base64 used for?
- Base64 encodes binary data as printable ASCII text, making it safe to transmit over systems that only handle text — email attachments, basic HTTP authentication headers (Authorization: Basic), data URIs in HTML, and JSON payloads that need to embed binary content.
- Which hash algorithm should I use?
- SHA-256 is the standard choice for new applications — it is fast, collision-resistant, and supported everywhere. Avoid MD5 and SHA-1 for security-sensitive uses as both have known collision vulnerabilities. SHA-512 offers a larger digest (64 bytes vs 32) but is rarely needed.
- Can I use this to hash passwords?
- No — MD5, SHA-1, SHA-256, and SHA-512 are general-purpose hash functions, not password hashing functions. For passwords, use bcrypt, scrypt, or Argon2, which are deliberately slow and include salting to resist brute-force attacks.
- What is the difference between Base64 encoding and encryption?
- Base64 is not encryption — it's a reversible text encoding with no secret key involved. Anyone can decode Base64 back to the original data instantly, with no password required. Encryption, by contrast, requires a secret key to reverse and is designed to keep data confidential from anyone without that key.
- What is the difference between MD5, SHA-1, and SHA-256?
- All three are hash functions that produce a fixed-length digest from any input, but they differ in output size and cryptographic strength: MD5 produces 128 bits and is now considered broken (collisions are practical to generate), SHA-1 produces 160 bits and is also deprecated for security use, and SHA-256 produces 256 bits and remains considered cryptographically strong for current use.
- Why is MD5 no longer recommended for security?
- Researchers demonstrated practical collision attacks against MD5 years ago, meaning two different inputs can be crafted to produce the same MD5 hash — which breaks the core guarantee a hash function is supposed to provide for security purposes like verifying file integrity or digital signatures.
- What is a hash function used for?
- Hash functions are used to verify data integrity (confirming a file wasn't corrupted or tampered with), generate checksums, index data efficiently, and as building blocks in other cryptographic protocols — but not, on their own, for storing passwords securely.