Free Online Encoders, Decoders & Hash Generators
Free encoding and decoding tools: Base64, URL percent-encoding, Morse code and eight hash generators covering MD5, SHA-1, SHA-256, SHA-512 and more.
Encode text, JSON or UTF-8 characters to Base64 in your browser. Learn how the 64-character alphabet and padding work, with copy-ready output.
Decode Base64 strings back to readable text, including UTF-8 and URL-safe variants, and see why padding or whitespace makes a string fail to decode.
Percent-encode or decode URLs and query strings with encodeURIComponent and encodeURI behaviour side by side, so you pick the right one every time.
Translate text to Morse code and Morse back to text, with the full international alphabet, numerals and punctuation reference on the same page.
Generate a hash from any text with twelve algorithms including MD5, SHA-1, SHA-256, SHA-512, CRC32, RIPEMD-160, Whirlpool and bcrypt. Free tool.
Generate a 32-character MD5 hash from any text instantly, and see why MD5 is still fine for checksums but broken for passwords and signatures.
Generate a 40-character SHA-1 hash from any text, and learn why the 2017 SHAttered collision retired SHA-1 from certificates and signatures.
Generate a 64-character SHA-256 hash from any text. The SHA-2 workhorse behind TLS certificates, Bitcoin and file integrity checks. Free online.
Generate a 128-character SHA-512 hash from any text. Faster than SHA-256 on 64-bit hardware and the basis of the sha512-crypt password scheme.
Generate a CRC32 checksum from any text. A fast error-detection code used by ZIP, PNG and Ethernet - and never a substitute for a secure hash.
Generate a 128-character Whirlpool hash from any text. The ISO-standardised AES-based digest designed by Barreto and Rijmen. Free browser tool.
Generate a 40-character RIPEMD-160 hash from any text. The European digest used in Bitcoin and Ethereum address derivation. Free online tool.
Generate a salted bcrypt password hash with a work factor. Unlike MD5 or SHA, bcrypt is deliberately slow, which is what makes it safe for passwords.
Encoding, encryption and hashing are three different things
Almost every support question about these tools comes from confusing the three. The distinction is not academic — getting it wrong is how passwords end up stored in a way that leaks.
| Reversible? | Needs a key? | What it is for | |
|---|---|---|---|
| Encoding (Base64, URL, Morse) | Yes, by anyone | No | Moving data safely through a channel that would mangle it |
| Encryption | Yes, with the key | Yes | Keeping data secret |
| Hashing (MD5, SHA, bcrypt) | No, by design | No | Verifying integrity or a password without storing it |
Base64 is not security. It is a way of writing binary data using 64 printable characters so it survives systems that only handle text. Anyone can decode it in one click — including on this site. If you have Base64-encoded something to hide it, it is not hidden.
Which hash should I use?
This site offers eight hash pages because people search for them by name, but they are not interchangeable and most of them should not be used for new work.
| Algorithm | Digest | Status in 2026 | Use it for |
|---|---|---|---|
| MD5 | 128-bit, 32 hex | Cryptographically broken (1996 onward) | Non-adversarial checksums, cache keys, deduplication |
| SHA-1 | 160-bit, 40 hex | Broken; collision demonstrated 2017 | Legacy compatibility only |
| SHA-256 | 256-bit, 64 hex | Secure — current default | Signatures, certificates, file integrity, blockchains |
| SHA-512 | 512-bit, 128 hex | Secure | Same as SHA-256; faster on 64-bit CPUs |
| RIPEMD-160 | 160-bit, 40 hex | No practical break, but narrow | Bitcoin and Ethereum address derivation |
| Whirlpool | 512-bit, 128 hex | Secure, rarely deployed | ISO/IEC 10118-3 compliance |
| CRC32 | 32-bit, 8 hex | Not cryptographic at all | Detecting accidental corruption in ZIP, PNG, Ethernet |
| bcrypt | Salted, 60 chars | Secure — correct for passwords | Storing user passwords |
The short version
Hashing a file to check it downloaded intact: SHA-256. Storing a user's password: bcrypt (or Argon2id, or scrypt) — never a plain SHA. Detecting accidental bit flips fast: CRC32. Everything else on the list is either legacy or niche.
Why a fast hash is the wrong tool for passwords
SHA-256 is designed to be fast, which is a virtue for verifying a 4GB ISO and a catastrophe for passwords: a modern GPU can compute billions of SHA-256 hashes per second, so a leaked table of SHA-256 password hashes is cracked at enormous speed. bcrypt is deliberately slow and has a tunable work factor, so you can make each guess cost milliseconds instead of nanoseconds. It also salts every hash automatically, which is why hashing the same password twice with bcrypt gives two different outputs — that is correct behaviour, not a bug.
URL encoding: encodeURI or encodeURIComponent?
This trips up experienced developers regularly. encodeURI is for encoding a whole URL and deliberately leaves the structural characters : / ? # [ ] @ & = + alone, because those characters do a job in a URL. encodeURIComponent is for encoding one piece — a query parameter value, a path segment — and escapes those characters, because inside a value they would otherwise break the structure.
Rule of thumb: if you are building a query string, every value goes through encodeURIComponent. The URL encoder shows both results side by side so you can see the difference on your own input.
These tools run in your browser
Base64, URL and Morse conversion all happen client-side, so the text you paste is not transmitted anywhere. The hash generators post to the server because they use PHP's hashing extensions, which means you should not paste a real production password into them — use them to understand the output format, not to hash live credentials.