Base64, hashes, UUID and ULID
Encode and decode text and files, compute hashes and HMACs, verify checksums, generate and inspect UUID v4/v7, ULID and NanoID — all in your browser, nothing you enter goes over the network.
Free, no sign-up
Everything runs in this browser: text, files and keys are not sent anywhere. Only settings are saved.
Edit either side — the other one updates instantly.
How it works
Encoding
Both sides are live: edit the text and Base64 (or another encoding) updates; paste Base64 and the text appears. Text is turned into bytes as UTF-8, and the counter shows both characters and bytes. A decoding error points at the broken character.
Files
A file is read in this tab and turned into Base64 and a data URI (up to 50.0 MB). The other way round: paste Base64 or a data: URL — the type is detected from the first bytes (signature), an image can be previewed and any file downloaded with the right extension.
Hashes
Text is hashed as you type. Files are read in 4 MB chunks in a background thread (Web Worker) — the page stays responsive, with progress and a stop button. All selected algorithms are computed in one pass over the file.
Verify and HMAC
Paste the hash from a download page — the tool compares it with every computed value and highlights the match. HMAC uses your key (text, HEX or Base64) with SHA-256/384/512.
Identifiers
UUID v7 and ULID carry their creation time and sort by it, UUID v4 is fully random, NanoID is a short ID with your own alphabet. The inspector shows the version, variant and time in your time zone.
Standards
Base64
- Standard
- RFC 4648 §4–5
- How it works
- 3 bytes → 4 characters; base64url for URLs and JWT; wrap at 64 (PEM) or 76 (MIME)
Base32
- Standard
- RFC 4648 §6
- How it works
- 5 bytes → 8 characters A–Z 2–7; TOTP secrets (Google Authenticator), case-insensitive
HEX
- Standard
- RFC 4648 §8
- How it works
- byte → 2 digits; space and colon separators (MAC, fingerprints)
URL
- Standard
- RFC 3986
- How it works
- UTF-8 percent-encoding; component, whole URL or form (space → +)
HTML
- Standard
- WHATWG HTML
- How it works
- & < > " ' and optionally all non-ASCII; the decoder knows named and numeric references
\uXXXX
- Standard
- ECMA-262 / JSON
- How it works
- \uXXXX (UTF-16, as in JSON) or \u{…} by code point; the decoder handles \x, \n, \t
Quoted-Printable
- Standard
- RFC 2045 §6.7
- How it works
- email headers and bodies: =XX for non-ASCII, soft line break at 76 characters
MD5
- Bits
- 128
- Standard
- RFC 1321
- Status
- broken: collisions in seconds, only for matching old checksums
SHA-1
- Bits
- 160
- Standard
- FIPS 180-4
- Status
- legacy: practical collision (SHAttered, 2017), not for signatures
SHA-224
- Bits
- 224
- Standard
- FIPS 180-4
- Status
- secure
SHA-256
- Bits
- 256
- Standard
- FIPS 180-4
- Status
- secure
SHA-384
- Bits
- 384
- Standard
- FIPS 180-4
- Status
- secure
SHA-512
- Bits
- 512
- Standard
- FIPS 180-4
- Status
- secure
SHA3-256
- Bits
- 256
- Standard
- FIPS 202
- Status
- secure
SHA3-512
- Bits
- 512
- Standard
- FIPS 202
- Status
- secure
BLAKE2b-512
- Bits
- 512
- Standard
- RFC 7693
- Status
- secure
BLAKE3-256
- Bits
- 256
- Standard
- BLAKE3 spec
- Status
- secure
CRC-32
- Bits
- 32
- Standard
- ISO 3309 / ITU-T V.42
- Status
- not cryptographic: catches accidental errors, trivial to forge
- Base64, base64url, Base32 and Base16 — RFC 4648 (sections 4, 5, 6, 8), tested against the section 10 vectors. MIME line wrap (76 characters) — RFC 2045 §6.8, Quoted-Printable — RFC 2045 §6.7, data: URI — RFC 2397, URL — RFC 3986.
- SHA-1 and SHA-2 — FIPS 180-4, SHA-3 — FIPS 202, BLAKE2b — RFC 7693, MD5 — RFC 1321, CRC-32 — the IEEE 802.3 polynomial (as in ZIP, PNG and gzip). Implementations come from the open, audited @noble/hashes library in plain JavaScript.
- HMAC — RFC 2104, tested against the RFC 4231 vectors (including a key longer than the block).
- UUID — RFC 9562 (replaced RFC 4122): v4 is 122 random bits; v7 is 48 bits of Unix time in milliseconds + 74 random bits, monotonic within a millisecond using method 2 of §6.2. The inspector understands v1 and v6 (time since 1582), Nil and Max UUIDs.
- ULID — the github.com/ulid/spec specification: 48 bits of time + 80 bits of randomness, Crockford Base32 (no I, L, O, U); monotonic mode increments the random part by 1 within one millisecond.
- NanoID — no distribution bias: out-of-range byte values are rejected by a mask rather than taken “modulo”.
Browser support
- Works in current Chrome, Edge, Firefox and Safari (desktop and mobile). It needs TextEncoder, crypto.getRandomValues and Web Workers — all browsers of recent years have them.
- If the background thread cannot start (for example, because of a browser security policy), file hashes are computed on the main thread with pauses between chunks — slower, but the page stays responsive. The tool tells you which mode is on.
- WebAssembly is not used: the site's security policy does not allow it, and plain JavaScript gives predictable results in every browser.
Limitations
- File → Base64 is limited to 50.0 MB: the Base64 string is a third larger than the file and lives fully in memory. The field shows the beginning of a long string; copy and download give you all of it.
- A file hash is limited only by time: the file is never loaded into memory in full. On a phone, a gigabyte file may take a minute.
- MD5 and SHA-1 are kept for matching old checksums. For anything new use SHA-256, SHA-3 or BLAKE3.
- This is not how passwords are stored: passwords need slow functions (Argon2id, scrypt, bcrypt) with a salt — a fast hash such as SHA-256 is brute-forced at billions of guesses per second.
- The HTML decoder knows about 150 of the most common named entities and all numeric ones; rare names are left as is with a note.
- File type by signature is a heuristic: DOCX, XLSX and APK are ZIP archives inside and are detected as ZIP.
Privacy
- Everything runs on your device: text, files, hashes and keys are not sent to a server and never appear in the page address.
- Only settings (encoding, options, selected algorithms, ID options) are saved in this browser's localStorage. Your text, files and HMAC key are not saved: after a reload they are gone.
- Randomness for UUID, ULID and NanoID comes from the browser's cryptographic generator (crypto.getRandomValues), not Math.random.
- Analytics receives only the fact of an action and a category (for example, “Base64 encoding”, “file hash”) — no content.
- The result reaches us only if you send a request yourself and keep the “Attach the result” box ticked — the form shows exactly what will be sent. Keys, passwords and tokens are never part of the summary: it lists only the operations used (encodings, hash and HMAC algorithms, ID types) and counts — no text, outputs, hashes, HMAC key, IDs or file names.
Related tools
All tools · 40
Image compressor (WebP/AVIF)Drop images in — WebP, AVIF or JPEG by quality or a target size in KB, a 1:1 before/after slider, srcset and <picture>, batch ZIP. All in the browser.
Favicon and app icon generatorFrom an image, SVG or a letter → favicon.ico, favicon.svg with dark mode, PNGs in every size, apple-touch-icon, maskable, manifest and HTML; tab, iOS and Android previews — in one archive.
Link preview (Open Graph) checkerPaste HTML or fill in fields and see how a link looks in Telegram, WhatsApp, VK, Facebook, X, LinkedIn and Slack. Checks for og:image, text length and twitter:card, plus a ready <head> block.
JSON, YAML and CSV converterConvert between JSON, YAML and CSV with formatting, key sorting, syntax errors pinned to the exact spot, and a data tree.
Regex testerMatches and groups highlighted as you type, replace, a step-by-step breakdown of the pattern, a library of ready patterns and freeze protection.
Cron expression helperA cron expression ↔ plain language, the next runs in your time zone, a schedule builder and variants for Linux, Quartz, GitHub Actions and Kubernetes.Need development with careful cryptography and APIs?
InterLAB builds web services and integrations: request signing, HMAC webhooks, database identifiers, safe file storage. The first conversation about your task is free.
- The first short conversation is free — we choose the format
- NDA — yours or ours
- Pricing after a brief and an agreed scope