Hash Lab: Hash, UUID, and Base64 tool
NewHash text or files, generate UUIDs and short IDs, and convert between Base64, URL, and HTML encodings.
Text digests update as you type. Selecting a file replaces them with that file's digests, which is how you verify a download against a published checksum.
The checks developers run every day
Verify a download, hash a string, mint an identifier, or fix an encoding — without pasting anything into a site that logs it.
Five digests at once
MD5, SHA-1, SHA-256, SHA-384, and SHA-512 for the same input, so you can match whichever checksum a project publishes.
File verification
Hash a local file to compare it against a published checksum before you install it.
UUID v4
Standards-compliant identifiers from crypto.randomUUID, one at a time or twenty-five at once.
URL-safe short IDs
21-character identifiers from a 62-character alphabet for links, invite codes, and object keys.
Five encodings
Base64, Base64 URL, URL component, full URL, and HTML entities, in both directions.
UTF-8 correct
Turkish, emoji, and other multi-byte characters survive a Base64 round trip instead of turning into mojibake.
Questions about hashing and encoding
Is my file uploaded when I hash it?
No. The file is read into memory in your browser and hashed there. Nothing is sent over the network, which is what makes this safe to use on files you cannot share.
Is Hash Lab free, and does it work offline?
Yes. Hash Lab is free, with no account, no sign-up, and no usage limit. It runs entirely in your browser, so once you have opened the page while online, it keeps working without a connection.
Can a hash be reversed?
Not by inverting it. A hash is one-way. Short or common inputs can still be recovered by guessing against precomputed tables, which is why passwords need a slow, salted algorithm such as bcrypt or Argon2, not a bare SHA digest.
Should I use MD5?
Only as a checksum against accidental corruption. MD5 and SHA-1 both have practical collision attacks, so never use them for signatures, integrity guarantees against a motivated attacker, or password storage. Use SHA-256 or stronger.
Is Base64 encryption?
No. It is an encoding, fully reversible by anyone. Use it to move binary data through text channels, never to hide a secret.
What is the difference between Base64 and Base64 URL?
Base64 URL replaces + with -, / with _, and drops the = padding, so the result is safe inside a URL or filename. Decoding here accepts both variants.
When should I use encodeURIComponent instead of encodeURI?
Use URL component for a single value you are placing into a query string or path segment, because it escapes /, ?, &, and =. Use full URL for an entire address, where those characters must survive.
Where to go next
The Labs people most often reach for straight after this one.