Understanding Base64 encoding
Base64 translates arbitrary binary data into 64 printable ASCII characters (A–Z, a–z, 0–9, +, /). Because raw binary bytes frequently break text-only communication channels like email protocols, JSON APIs, and URL query strings, Base64 ensures data survives transmission intact.
Every 3 input bytes (24 bits) are grouped and divided into 4 six-bit chunks, each indexing a
character in the Base64 alphabet. When the input byte count is not divisible by 3, equal signs (
=) are appended as padding.
Cryptographic hash functions explained
A cryptographic hash function computes a fixed-size digital fingerprint from any input payload. Hashes are deterministic: identical inputs always yield identical outputs, but even a single-bit alteration completely scrambles the resulting digest.
- MD5 (128-bit): Produces 32-character hex digests. Although no longer secure against collision attacks, MD5 remains popular for non-security checksums and database cache keys.
- SHA-1 (160-bit): Produces 40-character hex digests. Deprecated for TLS certificates but still common in Git commit identification.
- SHA-256 & SHA-512: Modern SHA-2 family functions standard in blockchain, software verification, and TLS cryptography.
Worked examples
-
Embedding images in CSS: Converting small PNG icons to Base64 data URIs (
data:image/png;base64,...) to reduce HTTP round-trips. -
Verifying release downloads: Computing the SHA-256 hash of an Ubuntu ISO or
CLI binary and comparing it against the project's published
SHA256SUMSmanifest. - API HMAC authentication: Generating a keyed SHA-256 digest over request headers to authenticate webhook payloads securely.
Common mistakes
- Treating Base64 as encryption: Anyone can reverse Base64 immediately. Never use Base64 to conceal secrets without encryption.
-
Using standard Base64 in URLs: Standard Base64 contains
+and/characters that URL parsers misinterpret. Always choose URL-safe Base64 for web parameters. - Relying on MD5 for password storage: MD5 hashes are cracked rapidly using rainbow tables and GPU clusters. Use salted bcrypt or Argon2 for passwords.
Frequently asked questions
Is Base64 an encryption algorithm?
No. Base64 is an encoding format designed to represent binary data in ASCII text. It provides no confidentiality and can be decoded instantly without a secret key.
What is URL-safe Base64?
Standard Base64 uses "+" and "/", which require percent-encoding in URLs and filenames. URL-safe Base64 replaces them with "-" and "_", making tokens safe for URL parameters and web headers.
Why should MD5 and SHA-1 not be used for security?
Both MD5 and SHA-1 suffer from collision vulnerabilities where attackers can produce matching hashes for different inputs. Use SHA-256 or SHA-512 for cryptographic integrity.
How do I verify a downloaded file against an official checksum?
Upload the file in the Hash generator tab, paste the author's published checksum into the "Verify against expected checksum" field, and the tool will automatically check for a match.
Are my files or passwords uploaded to a server?
No. All encoding, decoding, and cryptographic hashing runs locally in your browser using the Web Cryptography API and client-side JavaScript. No file bytes leave your device.