Runs in your browser · nothing is uploaded

Base64 Decode & Hash Toolkit

Base64 decode back to text or a file, encode UTF-8 text or any file to Base64, and generate MD5, SHA-1, SHA-256, SHA-384 or SHA-512 checksums — with files read locally, never uploaded.

Mode InputOptional file (overrides text)

MD5 and SHA-1 are legacy checksums. Base64 is encoding, not encryption. Maximum file size 20 MB.

Result

How Base64 and hashing work

Base64 encodeevery 3 bytes (24 bits) → four 6-bit values → four characters from A–Z a–z 0–9 + /
Padding1 byte left over → 2 characters + "==" · 2 bytes left over → 3 characters + "="
Encoded length4 × ceil(bytes ÷ 3) characters, about 33% larger than the input
Hashbytes → fixed-length digest, shown as lowercase hexadecimal (2 characters per byte)

Text is converted to UTF-8 bytes before anything else happens, so letters outside plain ASCII take more than one byte. "café" is 4 characters but 5 bytes (63 61 66 c3 a9), and encodes to Y2Fmw6k=. If you choose a file, its raw bytes are used and the text box is ignored.

Decoding runs the other way. Spaces and line breaks are stripped first, so you can paste wrapped Base64 from an email or a PEM block. If the decoded bytes are valid UTF-8 they are shown as text; otherwise they download as decoded.bin.

Worked example

Input text Hello, Northlane! — 17 UTF-8 bytes.

The first three bytes, "Hel", are 01001000 01100101 01101100. Split into four 6-bit groups they become SGVs. Repeating that across all 17 bytes gives 24 characters, with padding because 17 isn't a multiple of 3:

SGVsbG8sIE5vcnRobGFuZSE=

The same text hashed in each mode:

MD532 hex characters221140ba618b11497f18778b484125ed
SHA-140 hex characters79e50b2ddacc93069056115505845576a57585e0
SHA-25664 hex charactersa90aa2718dda128ce8881e60886acd70eaf3280afc02036566f5cc41a8948b96
SHA-38496 hex charactersca34642f37df939901d45bfd3e2fd5749b8c292dde95f20e453cfb4ec760aec5179b1d582f8ff88894a1b53234840412
SHA-512128 hex charactersaed4892e06cd2e2d23337d17cf1f99da49bc01acf3d560ae3fd5d9420ed2e0ef25eaef1c2401c4e0b2a04a31ada22304250430da3e263f0c036d3bdbd18101de

Add a single line break after the text and the SHA-256 becomes aafab61d94ca6d14… instead of a90aa2718dda128c… — which is why a pasted hash and a file hash often disagree.

MD5 and SHA-1 are legacy checksums. Base64 is encoding, not encryption. Maximum file size 20 MB.

Which hash to use

Algorithm	Bits	Typical use	Status
MD5	128	Legacy checksums, cache keys, spotting duplicate files	Broken for security — practical collisions since 2004
SHA-1	160	Legacy checksums and older systems	Broken for security — a real collision was published in 2017
SHA-256	256	Software download checksums, file integrity, signatures	Secure; the usual default
SHA-384	384	TLS cipher suites, Subresource Integrity (sha384-…)	Secure
SHA-512	512	File integrity where a longer digest is wanted	Secure

Checking a download

Use whichever algorithm the publisher lists — usually SHA-256. Hash the file you downloaded, not a copy you re-saved, and compare the full string. A match means the file is byte-for-byte what they hashed. It only proves authenticity if the checksum itself came from a trusted page.

Passwords are different

None of these five algorithms is suitable for storing passwords by itself. They are built to be fast. Password storage needs a deliberately slow, salted function such as Argon2id, scrypt, bcrypt or PBKDF2, so each guess costs an attacker real time.

When Base64 fits

Base64 is for moving bytes through places that only accept text: JSON fields, email attachments (MIME), HTTP Basic auth headers and data URLs. It adds about a third to the size and hides nothing. For images you want to inline in CSS or HTML, the Image Base64 converter builds the full data URL.

Sources: RFC 4648 (Base16, Base32 and Base64 encodings); NIST FIPS 180-4 (Secure Hash Standard); RFC 6151 (MD5 security considerations); Stevens et al., "The first collision for full SHA-1" (2017); OWASP Password Storage Cheat Sheet. Checked 15 October 2026.

Frequently asked questions

How do I verify a file's SHA-256 checksum?+

Choose SHA-256 as the mode, pick the file with "Optional file" and press Generate / convert. Compare the 64-character result with the checksum the publisher lists. Hex is case-insensitive, so ABC… and abc… match. If even one character differs, the file is not the one they published.

Why is my hash different from the one another tool gives?+

Hashes change completely when a single byte changes. The most common cause is an invisible newline: the SHA-256 of "Hello, Northlane!" starts a90aa2718dda…, but with a trailing line break it starts aafab61d94ca…. Windows line endings (CRLF) versus Unix (LF), a different text encoding than UTF-8, or hashing the text instead of the file cause the same thing.

Is Base64 encryption?+

No. Base64 is a reversible encoding with no key, so anyone can decode it. "Hello, Northlane!" always encodes to SGVsbG8sIE5vcnRobGFuZSE=. Use it to carry bytes through text-only channels such as JSON, email or data URLs — never to hide passwords or API keys.

How much bigger does Base64 make data?+

Base64 writes every 3 bytes as 4 characters, padding the last group with = signs, so output is about 33% larger. The 17-byte sample becomes 24 characters. A 20 MB file becomes roughly 26.7 MB of text.

Are MD5 and SHA-1 still safe to use?+

Not for security. Researchers can create two different inputs with the same MD5 or SHA-1 hash, so neither should be used for signatures, certificates or proving a file wasn't tampered with by an attacker. They are still fine for spotting accidental corruption or duplicate files. Use SHA-256 or stronger when it matters.

Can I use SHA-256 to hash passwords?+

Not on its own. SHA-256 is designed to be fast, which makes guessing billions of passwords cheap. Store passwords with a slow, salted password-hashing function such as Argon2id, scrypt, bcrypt or PBKDF2 instead.

What happens if the decoded Base64 isn't text?+

The tool tries to read the decoded bytes as UTF-8. If they are valid text, they appear in the result box. If not — an image or a ZIP, for example — the bytes are downloaded as decoded.bin and the result shows the byte count. Rename the file with the right extension to open it.

Does it decode Base64URL (with - and _)?+

Not directly. The decoder accepts the standard alphabet (A–Z, a–z, 0–9, + and /). Whitespace and line breaks are removed first, and missing = padding is tolerated. For Base64URL, such as a JWT segment, replace - with + and _ with / before decoding.

Why does Base64 end with = or ==?+

The = signs are padding. Base64 works in groups of 3 bytes, so when the data doesn't divide evenly the last group is padded: one leftover byte gives ==, two give =, and none gives no padding. For example "a" → YQ==, "ab" → YWI=, "abc" → YWJj.

Can a hash be decrypted back to the original text?+

No. MD5 and SHA hashes are one-way: they keep no copy of the input, and countless inputs share each possible hash. Sites that claim to "decrypt" MD5 just look the hash up in tables of common passwords and words, which is why short or common inputs are easy to find and long random ones aren't.

What's the difference between SHA-1, SHA-256, SHA-384 and SHA-512?+

Mainly the length of the result: 40, 64, 96 and 128 hex characters. SHA-1 is broken for security; the SHA-2 family (SHA-256, SHA-384, SHA-512) is considered secure. Use whichever one the publisher lists, because checksums only match when the algorithm matches.

Are my text and files uploaded?+

No. Text and files are read and processed in your browser with its built-in Base64 and Web Crypto functions; MD5 uses a small script loaded from this site. Nothing you enter or select is sent anywhere or stored, and files are limited to 20 MB so the browser stays responsive.