ToolsEveryday

Encode, decode & hash

Paste some text to see it in Base64, hex, URL encoding, HTML entities, Punycode and quoted-printable, and decoded from whichever it already is. Find hidden characters, and hash text or a file to check a download.

Runs entirely in your browser

Text

Hashes and checksums

What to hash

The text above A file

Expected hash (optional)

Hex or Base64, a line from a SHA256SUMS file, or an SRI value like sha384-… Hex is compared whatever its case.

How this works

Everything happens in this page's JavaScript, on your device. Nothing is sent to abbott.cloud or anywhere else, so the request log below stays empty.
Text is turned into bytes as UTF-8, then each encoding is applied to those bytes: Base64 (RFC 4648), hex, percent-encoding (RFC 3986), quoted-printable (RFC 2045). Decoded bytes are shown as text if they're valid UTF-8, keeping a byte order mark (U+FEFF) at the start if there is one.
Domain names are converted with Punycode (RFC 3492) after the first IDNA mapping steps: compatibility forms such as full-width letters become ordinary ones (NFKC), letters are lowercased, and ideographic and full-width dots (。．｡) are read as dots (RFC 3490 §3.1).
HTML references are read the way browsers read them in text, from a built-in list of common names plus every numeric form. As in browsers, an unknown name that starts with one of the old names they accept without a semicolon is read as that name: &notit; is ¬it;. A JSON Web Token's header and payload are shown as written, not parsed and printed again.
The inspector points out every character Unicode lists as a format or default-ignorable character (programs draw these as nothing), along with unusual spaces, control characters and look-alike letters.
SHA-1 and SHA-2 hashes come from your browser's own WebCrypto. MD5 (RFC 1321) and CRC-32 are worked out by this page's code.
A file is read in 8 MB pieces with FileReader, so even large files don't freeze the page.

What's kept: nothing. Text you type isn't added to this page's address, so it stays out of your browser history. A link with ?q= opens with that text filled in.

Limitations:

Punycode follows the main IDNA mapping steps, not every rule in UTS #46, so a few unusual characters convert differently from a browser.
Only common named HTML references are known (HTML has over 2,000); others are reported and left as they are.
Look-alike checks cover the Cyrillic, Greek and Armenian letters most used in fake addresses, not the whole Unicode confusables list.
Text is read in one go, so a paste of several megabytes, such as an image's data: URL, takes a second or two. The page says it's reading while it does.

Code: encode.js (this page), lib/encoding.js (encodings, MD5, CRC-32 and the character checks), bytes.js (Base64 and UTF-8), domain.js (Punycode).