Security Tools & Encryption Utilities
Browser-based tools for AES and RSA encryption, cryptographic hashing, HMAC signing, bcrypt password hashing, and secure key generation. No data is uploaded or stored — every operation runs locally in your browser.
22 tools covering encryption, hashing, password security, API security, and encoding utilities.
Why Encryption and Hashing Matter
Every application that stores credentials, transmits sensitive data, or calls external APIs depends on cryptographic primitives. The cost of choosing the wrong one is high: MD5-hashed passwords cracked in seconds, padding-oracle vulnerabilities exposing plaintext, or unauthenticated ciphertext silently modified in transit. Cryptography is not optional in production systems, and the difference between secure and insecure is often a single function call.
Encryption, Hashing, and Encoding Serve Different Purposes
Encryption transforms plaintext into ciphertext using a secret key. The operation is reversible — given the correct key, you recover the original data. AES-256 is the standard for symmetric encryption, where a single key is used for both encrypt and decrypt. RSA and ECC are used for asymmetric operations, where a public key encrypts and a private key decrypts. Use encryption when data must be readable again later. See AES vs RSA for a breakdown of symmetric versus asymmetric encryption.
When selecting an AES mode, prefer AES-GCM over AES-CBC. AES-GCM is an AEAD (Authenticated Encryption with Associated Data) mode: it guarantees both confidentiality and integrity in a single pass. AES-CBC provides confidentiality only and is vulnerable to padding oracle attacks without a separate message authentication code.
Hashing is a one-way transformation. A cryptographic hash function produces a fixed-size digest from arbitrary input. The same input always produces the same digest, but you cannot reverse a digest to recover the input. Use SHA-256 for checksums and data integrity. HMAC-SHA256 adds a secret key to the process, making it suitable for API signature verification and webhook authentication. Never use MD5 or SHA-1 for new security work — both have well-documented collision vulnerabilities.
Encoding (Base64, URL encoding, hex) is not a security mechanism. These schemes transform data for transport or storage compatibility and are fully reversible without any secret. Treating Base64-encoded data as obfuscated or secure is a common and expensive mistake. See Encoding and Encryption: What's the Difference? for a clear breakdown.
Password Storage Requires a Slow Hash Function
Storing passwords with a general-purpose hash (SHA-256, MD5) is a critical vulnerability. These algorithms are designed to be fast — an attacker with consumer GPUs can compute billions of SHA-256 hashes per second, making offline brute-force trivial. Password hashing algorithms are specifically designed to be slow and memory-intensive. They include a random salt per password to prevent rainbow table attacks and a configurable cost factor that can be increased as hardware improves.
- bcrypt — the most widely deployed option. Use a cost factor of 12 or higher for new systems.
- Argon2id — winner of the 2015 Password Hashing Competition. Recommended for new systems. Stronger memory hardness than bcrypt.
- PBKDF2 — FIPS 140-2 compliant. Required in some regulated environments but offers weaker memory hardness than Argon2id.
See How Password Hashing Works and the bcrypt vs Argon2 vs PBKDF2 comparison for a full breakdown.
Transport Security and API Authentication
TLS (Transport Layer Security) is the cryptographic protocol behind HTTPS. It provides confidentiality, integrity, and server authentication for data in transit. TLS 1.3 is the current standard; TLS 1.0 and 1.1 are deprecated. See What Is TLS? for a practical explanation of how the handshake works and what it protects against.
For API authentication and message integrity, HMAC verifies that a request originated from the holder of a shared secret and was not altered in transit. HMAC-SHA256 is used in webhook signature verification, JWT signing (HS256 algorithm), and AWS Signature Version 4. Use HMAC when you need integrity with a shared secret; use asymmetric signatures (RSA-PSS, ECDSA) when you need non-repudiation.
Security & Encryption Tools
All tools run entirely in your browser. No data is sent to any server.
Encryption Tools
Encrypt and decrypt data using industry-standard algorithms. All processing runs in your browser.
Hashing & Integrity Tools
Generate cryptographic hashes and HMAC signatures for checksums, integrity checks, and password storage.
Password & Key Utilities
Generate strong passwords, passphrases, PINs, and API keys with cryptographically secure randomness.
More Security Tools
Additional security and cryptography utilities.
Security Guides & Comparisons
Authoritative reference pages to help you choose the right algorithm, understand the trade-offs, and avoid common mistakes.
A practical reference to encoding, hashing, encryption, and signing—what they are and when to use each.
A practical guide to hashing and HMAC—how they differ, what problems they solve, and how to choose the right approach for integrity and authentication.
A practical guide to authenticated encryption — what AEAD is, how AES-GCM and ChaCha20-Poly1305 work, and when to use each mode over CBC or CTR.
Learn how password hashing works, why MD5 and SHA-256 are insufficient for passwords, what salting and key stretching do, and which algorithm to use today.
A practical explanation of TLS — what it protects, how the handshake works, certificates and trust, and common mistakes developers make.
The difference between encryption at rest and in transit — threat models, technologies, key management, real-world examples, and common mistakes.
How digital signatures work — hash, sign with private key, verify with public key. Covers signature vs HMAC, real-world uses (JWTs, TLS, code signing), and common mistakes.
Avoid the most costly encryption errors: using encryption for passwords, hardcoding keys, skipping authenticated modes, ignoring certificate warnings, and more.
A practical guide to API authentication — understand API keys, JWT, OAuth 2.0, and HMAC request signing, when to use each, and how to choose the right approach.
A practical guide to HMAC API signing — how to sign requests with a shared secret, prevent replay attacks with timestamps, and verify webhook payloads from Stripe, GitHub, and AWS.
API rate limiting controls how many requests a client can make in a given window. Covers fixed window, sliding window, token bucket, and leaky bucket algorithms, where to enforce limits, and common mistakes.
Understand the full JWT authentication flow — token structure, signing algorithms (HS256 vs RS256 vs ES256), refresh token patterns, and the vulnerabilities that break most implementations.
A practical guide to data formats for engineers — understand CSV, JSON, XML, and Excel, when to use each, and how to validate, convert, and transform data without writing a pipeline.
A practical guide to working with JSON data — how to validate, flatten, diff, convert, and move JSON between systems without writing a full pipeline.
JSON Schema is a vocabulary for defining structure and validation rules for JSON documents. Learn core keywords, practical validation workflows, and when to use JSON Schema in APIs, pipelines, and config files.
A practical guide to DevOps configuration and deployment — understand YAML, DNS records, SSL/TLS certificates, HTTP headers, cron schedules, and robots.txt. Includes validation workflows and common deployment mistakes.
A practical guide to SSL/TLS certificates — certificate types (DV, OV, EV), how certificate chains and trust work, how Let's Encrypt issues certificates via ACME, SANs and wildcards, and how to debug common certificate problems.
A practical guide to cron jobs and task scheduling — understand the five-field cron expression syntax, special strings, common patterns, timezone behaviour, and how cron works in Linux, GitHub Actions, Kubernetes CronJobs, and cloud schedulers.
A practical reference to HTTP request and response headers — what they are, common types, debugging workflows, and how headers affect caching, authentication, and browser security.
A practical guide to API and webhook integrations — request-response vs event-driven patterns, debugging API calls, inspecting webhook payloads, common integration mistakes, and the tools that make it faster.
A practical guide to debugging webhook integrations — common failure modes, step-by-step inspection workflows, logging strategies, and the tools that make it faster.
A step-by-step guide to diagnosing API request failures — from reading status codes and inspecting headers to reproducing errors with cURL and fixing CORS, auth, and payload issues.
Webhook senders retry on failure — your handler will receive the same event more than once. Covers how retries work, deduplication strategies, and how to design idempotent webhook handlers.
Symmetric vs asymmetric encryption—how they differ and how modern systems use both together.
Understand the difference between Base64 encoding and URL encoding, when to use each, and common mistakes developers make.
Understand the difference between SHA-256 hashing and HMAC-SHA256, when to use each, and how they relate to integrity and authentication.
Symmetric uses one shared key; asymmetric uses a public/private key pair. Learn how each works, when to use AES vs RSA, and why modern systems use both.
MD5 is fast but cryptographically broken. SHA-256 is the current standard. Compare output size, collision resistance, speed, and when to use each.
Compare bcrypt, Argon2id, and PBKDF2 for secure password storage. Understand work factors, memory hardness, GPU resistance, FIPS compliance, and which to use today.
AES-GCM provides authenticated encryption (AEAD) and is mandated by TLS 1.3. AES-CBC provides confidentiality only and is vulnerable to padding oracle attacks. Compare modes, security risks, and use cases.
ECC achieves equivalent security to RSA with dramatically smaller keys — a 256-bit ECC key matches a 3072-bit RSA key. Compare performance, signature size, key sizes, and when to use each in TLS, JWT, and SSH.
API keys are simple and easy to revoke; JWTs are stateless and carry embedded claims. Compare their trade-offs and learn which to use for your use case.
JWTs are stateless and self-contained; session cookies require server-side storage but offer easy revocation. Compare trade-offs and learn which to choose for your auth system.
API keys are simple opaque credentials suited for server-to-server calls; OAuth delegates user authorization without sharing passwords. Compare use cases, complexity trade-offs, and migration considerations.
OAuth 2.0 handles authorization (access tokens); OIDC adds authentication (ID tokens, user identity) on top. Understand when you need both and the implementation mistakes that mix them up.
JSON is lightweight and maps to objects natively; XML adds namespaces, schemas, and document structure. Compare verbosity, validation, streaming, and real-world use cases to pick the right format.
CSV is simpler and better for tabular data; JSON handles nested structures and is the standard for APIs. Compare verbosity, schema support, tooling, and real-world use cases.
CSV is plain text and universally portable; Excel (.xlsx) adds data types, formatting, multiple sheets, and formulas. Compare file size, automation compatibility, and use cases for analytics, pipelines, and human editing.
YAML supports comments, multi-line strings, and cleaner syntax for human-authored configs. JSON is stricter, universally supported, and the standard for APIs. Compare structure, tooling, validation, and failure modes.
HTTPS is HTTP over TLS — it adds encryption, server authentication, and data integrity. Learn why HTTPS is the baseline for all web traffic, what it does and does not protect, how it affects performance, and common migration mistakes.
DNS routing resolves domain names to IP addresses before a connection is made. HTTP routing directs requests to backends based on path, hostname, or headers after the connection is established. Most production systems use both together.
Understand how reverse proxies and load balancers differ in purpose, layer, and usage — with a comparison table and typical modern architecture.
Webhooks push events to your server in real time; polling pulls data on a schedule. Compare efficiency, reliability, complexity, and use cases to choose the right integration pattern for your SaaS.
REST is simple and cacheable; GraphQL eliminates over-fetching with precise queries. Compare flexibility, caching, complexity, and real-world use cases.
Webhooks push events to an external HTTP endpoint in real time; message queues buffer events internally for reliable async processing. Compare delivery model, retry behavior, ordering, failure recovery, and use cases.
Webhooks push HTTP callbacks to a single endpoint; event streaming platforms (Kafka, Kinesis, Pub/Sub) persist events in a durable log for multiple consumers. Compare delivery model, ordering, fan-out, replay, and complexity.
Frequently Asked Questions
What is the difference between encryption and hashing?
Encryption is reversible — given the correct key, you recover the original data. Hashing is one-way: you cannot reconstruct the input from the digest. Use encryption when data must be readable again; use hashing for integrity checks and password storage.
Which password hashing algorithm should I use?
Use Argon2id for new systems — it won the 2015 Password Hashing Competition and provides strong memory hardness. Use bcrypt (cost factor 12+) if Argon2 is unavailable. Use PBKDF2 only when FIPS 140-2 compliance is required. Never use MD5, SHA-1, or unsalted SHA-256 for passwords.
What is TLS and why does it matter?
TLS (Transport Layer Security) is the cryptographic protocol behind HTTPS. It provides confidentiality, integrity, and server authentication for data in transit. TLS 1.3 is the current standard. Avoid TLS 1.0 and 1.1 — both are deprecated and disabled in modern browsers.
Is Base64 encoding secure?
No. Base64 is an encoding scheme, not encryption. It transforms binary data into printable ASCII characters for transport compatibility. It is fully reversible without any secret key. Never use Base64 as a substitute for encryption or to "obfuscate" sensitive data.