An all-in-one developer utility for Base64 text & file encoding/decoding, MD5/SHA-256/SHA-512 cryptographic hashing, and Unix timestamp epoch conversion. 100% in-browser — 0 bytes uploaded anywhere.
Your data never leaves this browser.
Encoding, decoding, hashing, and timestamp conversions happen 100% locally — 0 bytes uploaded to any server. Completely safe for private keys, tokens, and files.
Geek check: open DevTools → Network tab — 0 bytes of your data uploaded.
Base64 encoding is an encoding scheme that translates binary data or arbitrary text into an ASCII string format using a radix-64 representation. In standard Base64 (RFC 4648), the characters + and / are used for indices 62 and 63, with = used for byte alignment padding. However, when placing Base64 strings inside URLs, filenames, or JSON Web Tokens (JWTs), standard characters like + and / can be misread as path separators or query string delimiters. The URL-safe Base64 variant replaces + with - and / with _, and strips the trailing padding =, ensuring seamless transmission without percent-encoding.
Cryptographic hash functions generate fixed-length digital fingerprints from arbitrary inputs. Choosing the right algorithm depends on your security model:
Standard Base64 uses '+' and '/' as characters 62 and 63, and '=' for padding. Because '+', '/', and '=' have reserved syntactic meanings in URLs and query strings, URL-safe Base64 (RFC 4648 §5) substitutes '-' for '+' and '_' for '/', and typically removes '=' padding. This allows the encoded string to be passed safely in URL paths, query parameters, or JWT tokens without escaping.
It depends entirely on whether your use case is security-sensitive. MD5 and SHA-1 have known practical collision vulnerabilities — an attacker can generate two different files that produce the exact same MD5 hash. Therefore, MD5 and SHA-1 should ONLY be used for quick non-cryptographic checksums, file deduplication, or legacy cache keys. For passwords, digital signatures, integrity verification, or API auth tokens, always choose SHA-256 or SHA-512.
The most common issue is confusing Unix seconds with Unix milliseconds. Standard Unix epoch timestamps in seconds are 10 digits (e.g. 1799999999 in 2027). Millisecond timestamps (common in JavaScript Date.now()) are 13 digits. If you pass a 13-digit millisecond value into a system expecting seconds, it interprets the value as tens of thousands of years in the future. This tool automatically detects whether your input is in seconds or milliseconds.
Yes. All computations — Base64 encoding/decoding, SHA/MD5 hashing, and timestamp conversions — execute entirely in your web browser via client-side JavaScript and the Web Crypto API. Zero bytes of your text or files are ever transmitted to our server or any third party. However, remember that if you hash a weak or dictionary password with MD5 or SHA-256, anyone who obtains that hash can reverse it using offline precomputed rainbow tables; production passwords should always use salted slow hashes like Argon2 or bcrypt.
By default, timestamp conversions display in your browser's detected local timezone as well as standard UTC and ISO 8601. You can toggle between Local and UTC in the timezone selector above to view dates and generate timestamps formatted specifically in your preferred zone.