Hash Generator & Encoder is a free, browser-based cryptography tool by Aibrify that generates MD5, SHA-256, SHA-512 hashes and encodes/decodes Base64, URL, HTML entities, and JWT tokens without uploading data to any server. Built for developers and marketers who need fast, private hashing and encoding utilities.
Understanding Cryptographic Hash Functions
A cryptographic hash function takes any input and produces a fixed-size output (the hash or digest) that is unique to that input. Even a single character change in the input produces a completely different hash. This property, called the avalanche effect, makes hash functions essential for data integrity verification, digital signatures, and password storage.
Our free hash generator supports five algorithms: MD5 (128-bit), SHA-1 (160-bit), SHA-256 (256-bit), SHA-384 (384-bit), and SHA-512 (512-bit). All SHA hashes are computed using the browser's native crypto.subtle API for maximum performance and security.
When to Use Each Hash Algorithm
- MD5 -- Fast but cryptographically broken. Use only for non-security checksums (file deduplication, cache keys). Never use for passwords or security.
- SHA-1 -- Deprecated for security purposes since 2017. Collisions have been demonstrated (SHAttered attack). Use only for legacy compatibility.
- SHA-256 -- The most widely used secure hash. Used in SSL/TLS certificates, Bitcoin, Git commits, and code signing. Recommended for most applications.
- SHA-384 -- Truncated version of SHA-512. Used in some TLS cipher suites and government standards (FIPS 180-4).
- SHA-512 -- Strongest hash in the SHA-2 family. Preferred for maximum security and slightly faster than SHA-256 on 64-bit processors.
Base64 Encoding Explained
Base64 is a binary-to-text encoding scheme that represents binary data using 64 printable ASCII characters. Every 3 bytes of input become 4 Base64 characters, making the output approximately 33% larger than the input. Common use cases include:
- Data URIs -- Embedding images directly in HTML or CSS without separate HTTP requests.
- Email attachments -- MIME encoding uses Base64 to transmit binary files over text-based email protocols.
- API payloads -- Sending binary data (images, files) within JSON or XML API requests.
- JWT tokens -- Both the header and payload of a JWT are Base64URL-encoded.
URL Encoding Best Practices
URL encoding ensures special characters are safely transmitted in URLs. The key rules are:
- Reserved characters (: / ? # [ ] @ ! $ & ' ( ) * + , ; =) have special meaning in URLs and must be encoded when used as data.
- Unsafe characters (spaces, <, >, {'{'}, {'}'}, |, \, ^, ~) should always be encoded.
- Unreserved characters (A-Z, a-z, 0-9, -, _, ., ~) never need encoding.
- Use
encodeURIComponent()for individual query parameter values. UseencodeURI()for complete URLs where you want to preserve the URL structure.
JWT Token Structure and Security
A JSON Web Token consists of three Base64URL-encoded parts separated by dots: xxxxx.yyyyy.zzzzz. The Header specifies the signing algorithm (e.g., HS256, RS256). The Payload contains claims -- standard claims like exp (expiration), iat (issued at), sub (subject), and custom claims like user roles or permissions. The Signature is created by hashing the header and payload with a secret key.
Important: JWTs are not encrypted by default. The payload is only Base64-encoded, meaning anyone can read it. Never store sensitive data (passwords, credit card numbers) in JWT payloads. Use JWE (JSON Web Encryption) if payload confidentiality is required.