Encryption & Hashing
Hashing, encryption and password storage are three different problems, and the most common production bug is using one where another belongs. Hashing is one-way and answers "is this the same input". Encryption is reversible and answers "can someone else read it". Password storage needs a third thing: a hash that is deliberately slow.
Everything here runs locally in your browser. That matters for keys and tokens — pasting a production secret into a remote converter is the same as publishing it.
- AES Encryption
- bcrypt Hash and Verify
- File HashCompute MD5, SHA-1, SHA-256/384/512, SHA3-256/512 and BLAKE2b checksums of any file entirely in your browser. Multi-file batches, 2 MB chunked streaming, and instant verification against an expected hash. Files are never uploaded.
- RSA Encrypt, Decrypt, Sign & VerifyGenerate RSA key pairs (1024 / 2048 / 4096 bit) or import existing PEM keys to encrypt, decrypt, sign and verify. Supports PKCS#1 v1.5 and OAEP with SHA-256 / SHA-1 / SHA-512, warns about the plaintext size limit, and runs entirely in your browser.
- SM2 Encrypt, Decrypt, Sign & VerifyGenerate SM2 key pairs or use existing keys to encrypt, decrypt, sign and verify. Supports both C1C3C2 (Chinese standard) and C1C2C3 ciphertext layouts, raw and DER signatures, and a configurable userId — all local in your browser.
- SM4 Encryption (ECB / CBC)Encrypt or decrypt with the Chinese SM4 block cipher: ECB / CBC, PKCS#7 padding, [HEX]: prefixed keys and IVs, and UTF-8 / GBK / UTF-16LE / Base64 / Hex for both sides. Runs entirely in your browser.
- Text HashCompute MD5, SHA-1, SHA-256, SHA-384, SHA-512, SHA3, SM3 and CRC32 for any text. UTF-8 input matches command-line sha256sum output.
Guides in this category
Common questions
Should I encrypt a password or hash it?
Hash it, with bcrypt, scrypt or Argon2 — never a fast hash like SHA-256, and never encryption (which is reversible by whoever holds the key).
Are these tools safe for real secrets?
The computation happens in your browser and nothing is uploaded, but a browser tab is still a shared environment. For production keys, use a local CLI.