Security Tools & Encryption Utilities
Browser-based tools for AES and RSA encryption, cryptographic hashing, HMAC signing, bcrypt password hashing, and secure key generation. No data is uploaded or stored — every operation runs locally in your browser.
10 tools covering encryption, hashing, password security, API security, and encoding utilities.
Why Encryption and Hashing Matter
Every application that stores credentials, transmits sensitive data, or calls external APIs depends on cryptographic primitives. The cost of choosing the wrong one is high: MD5-hashed passwords cracked in seconds, padding-oracle vulnerabilities exposing plaintext, or unauthenticated ciphertext silently modified in transit. Cryptography is not optional in production systems, and the difference between secure and insecure is often a single function call.
Encryption, Hashing, and Encoding Serve Different Purposes
Encryption transforms plaintext into ciphertext using a secret key. The operation is reversible — given the correct key, you recover the original data. AES-256 is the standard for symmetric encryption, where a single key is used for both encrypt and decrypt. RSA and ECC are used for asymmetric operations, where a public key encrypts and a private key decrypts. Use encryption when data must be readable again later. See AES vs RSA for a breakdown of symmetric versus asymmetric encryption.
When selecting an AES mode, prefer AES-GCM over AES-CBC. AES-GCM is an AEAD (Authenticated Encryption with Associated Data) mode: it guarantees both confidentiality and integrity in a single pass. AES-CBC provides confidentiality only and is vulnerable to padding oracle attacks without a separate message authentication code.
Hashing is a one-way transformation. A cryptographic hash function produces a fixed-size digest from arbitrary input. The same input always produces the same digest, but you cannot reverse a digest to recover the input. Use SHA-256 for checksums and data integrity. HMAC-SHA256 adds a secret key to the process, making it suitable for API signature verification and webhook authentication. Never use MD5 or SHA-1 for new security work — both have well-documented collision vulnerabilities.
Encoding (Base64, URL encoding, hex) is not a security mechanism. These schemes transform data for transport or storage compatibility and are fully reversible without any secret. Treating Base64-encoded data as obfuscated or secure is a common and expensive mistake. See Encoding and Encryption: What's the Difference? for a clear breakdown.
Password Storage Requires a Slow Hash Function
Storing passwords with a general-purpose hash (SHA-256, MD5) is a critical vulnerability. These algorithms are designed to be fast — an attacker with consumer GPUs can compute billions of SHA-256 hashes per second, making offline brute-force trivial. Password hashing algorithms are specifically designed to be slow and memory-intensive. They include a random salt per password to prevent rainbow table attacks and a configurable cost factor that can be increased as hardware improves.
- bcrypt — the most widely deployed option. Use a cost factor of 12 or higher for new systems.
- Argon2id — winner of the 2015 Password Hashing Competition. Recommended for new systems. Stronger memory hardness than bcrypt.
- PBKDF2 — FIPS 140-2 compliant. Required in some regulated environments but offers weaker memory hardness than Argon2id.
See How Password Hashing Works and the bcrypt vs Argon2 vs PBKDF2 comparison for a full breakdown.
Transport Security and API Authentication
TLS (Transport Layer Security) is the cryptographic protocol behind HTTPS. It provides confidentiality, integrity, and server authentication for data in transit. TLS 1.3 is the current standard; TLS 1.0 and 1.1 are deprecated. See What Is TLS? for a practical explanation of how the handshake works and what it protects against.
For API authentication and message integrity, HMAC verifies that a request originated from the holder of a shared secret and was not altered in transit. HMAC-SHA256 is used in webhook signature verification, JWT signing (HS256 algorithm), and AWS Signature Version 4. Use HMAC when you need integrity with a shared secret; use asymmetric signatures (RSA-PSS, ECDSA) when you need non-repudiation.
Security & Encryption Tools
All tools run entirely in your browser. No data is sent to any server.
Encryption Tools
Encrypt and decrypt data using industry-standard algorithms. All processing runs in your browser.
Hashing & Integrity Tools
Generate cryptographic hashes and HMAC signatures for checksums, integrity checks, and password storage.
Password & Key Utilities
Generate strong passwords, passphrases, PINs, and API keys with cryptographically secure randomness.
Security Guides & Comparisons
Authoritative reference pages to help you choose the right algorithm, understand the trade-offs, and avoid common mistakes.
A practical reference to encoding, hashing, encryption, and signing—what they are and when to use each.
A practical guide to hashing and HMAC—how they differ, what problems they solve, and how to choose the right approach for integrity and authentication.
A practical guide to authenticated encryption — what AEAD is, how AES-GCM and ChaCha20-Poly1305 work, and when to use each mode over CBC or CTR.
Learn how password hashing works, why MD5 and SHA-256 are insufficient for passwords, what salting and key stretching do, and which algorithm to use today.
A practical explanation of TLS — what it protects, how the handshake works, certificates and trust, and common mistakes developers make.
The difference between encryption at rest and in transit — threat models, technologies, key management, real-world examples, and common mistakes.
How digital signatures work — hash, sign with private key, verify with public key. Covers signature vs HMAC, real-world uses (JWTs, TLS, code signing), and common mistakes.
Avoid the most costly encryption errors: using encryption for passwords, hardcoding keys, skipping authenticated modes, ignoring certificate warnings, and more.
A practical guide to API authentication — understand API keys, JWT, OAuth 2.0, and HMAC request signing, when to use each, and how to choose the right approach.
Symmetric vs asymmetric encryption—how they differ and how modern systems use both together.
Understand the difference between Base64 encoding and URL encoding, when to use each, and common mistakes developers make.
Understand the difference between SHA-256 hashing and HMAC-SHA256, when to use each, and how they relate to integrity and authentication.
Symmetric uses one shared key; asymmetric uses a public/private key pair. Learn how each works, when to use AES vs RSA, and why modern systems use both.
MD5 is fast but cryptographically broken. SHA-256 is the current standard. Compare output size, collision resistance, speed, and when to use each.
Compare bcrypt, Argon2id, and PBKDF2 for secure password storage. Understand work factors, memory hardness, GPU resistance, FIPS compliance, and which to use today.
AES-GCM provides authenticated encryption (AEAD) and is mandated by TLS 1.3. AES-CBC provides confidentiality only and is vulnerable to padding oracle attacks. Compare modes, security risks, and use cases.
ECC achieves equivalent security to RSA with dramatically smaller keys — a 256-bit ECC key matches a 3072-bit RSA key. Compare performance, signature size, key sizes, and when to use each in TLS, JWT, and SSH.
API keys are simple and easy to revoke; JWTs are stateless and carry embedded claims. Compare their trade-offs and learn which to use for your use case.
Frequently Asked Questions
What is the difference between encryption and hashing?
Encryption is reversible — given the correct key, you recover the original data. Hashing is one-way: you cannot reconstruct the input from the digest. Use encryption when data must be readable again; use hashing for integrity checks and password storage.
Which password hashing algorithm should I use?
Use Argon2id for new systems — it won the 2015 Password Hashing Competition and provides strong memory hardness. Use bcrypt (cost factor 12+) if Argon2 is unavailable. Use PBKDF2 only when FIPS 140-2 compliance is required. Never use MD5, SHA-1, or unsalted SHA-256 for passwords.
What is TLS and why does it matter?
TLS (Transport Layer Security) is the cryptographic protocol behind HTTPS. It provides confidentiality, integrity, and server authentication for data in transit. TLS 1.3 is the current standard. Avoid TLS 1.0 and 1.1 — both are deprecated and disabled in modern browsers.
Is Base64 encoding secure?
No. Base64 is an encoding scheme, not encryption. It transforms binary data into printable ASCII characters for transport compatibility. It is fully reversible without any secret key. Never use Base64 as a substitute for encryption or to "obfuscate" sensitive data.