Paste JSON on the left and see it formatted live on the right as a collapsible tree, with syntax validation and error locating, expand/collapse, minify, escape/unescape and copyable node paths. All processed locally, nothing uploaded.
Convert between Base64 and text, images or any file. Paste a whole data URI and it is detected automatically; decoded images are previewed inline. Everything is converted locally — nothing is uploaded.
Convert Unix timestamps to dates and back. Auto-detects 10-digit (seconds) and 13-digit (milliseconds) input, switches between your local timezone and UTC, and shows the current timestamp live at the top of the page.
Convert between percent-encoded URLs and plain text in both directions, with UTF-8 and GBK support, an option to read + as a space, a choice of encodeURIComponent or encodeURI, and automatic breakdown of every query parameter when you paste a whole link.
Compute the MD5 of text or a file, with 16- or 32-character output and an upper/lowercase switch. Everything is computed locally; nothing is uploaded.
Compute the SHA-256 of text or a file, with SHA-1, SHA-384 and SHA-512 also available. Paste the publisher's hash and it is checked for you. Everything runs locally — nothing is uploaded.
Generate strong random passwords for free, with custom length, character sets, excluded look-alike characters and batch size.
Turn a URL or any text into a QR code online. Adjust error correction, size, quiet zone and colours, then download PNG or SVG. Static codes — the content is encoded in the pattern itself, so they never expire and nothing is uploaded.
What developers paste into online tools tends to be far more sensitive than it feels at the time: an API response carrying users' phone numbers, a request header with a token in it, a slice of JSON dumped from the production database, a config file about to be committed. Pasting that into a site that ships the content back to a server hands a piece of live production data to a third party you know nothing about — and tool sites like that often do not even have a privacy policy. Everything here is computed with native browser capabilities (hashing via WebCrypto, encoding and decoding via the built-in APIs); the page keeps working after you go offline, and you can open the Network panel in DevTools and confirm for yourself that no request is ever made.
This is the most common misconception around these tools, and it runs in both directions. MD5 and SHA-256 are one-way hashes: the same input always produces the same output, but there is no way to work backwards from the result to the original. The so-called "MD5 decryption" sites are really just looking the value up in a precomputed dictionary, which only works for weak passwords. Base64 is the opposite — it is a reversible encoding that anyone can undo. Its purpose is to let binary content travel safely inside a text protocol; it offers no confidentiality whatsoever. Storing a password Base64-encoded in your database is no different from storing it in plain text.
For checking file integrity — confirming that the image you downloaded is not corrupted or substituted — the answer today is SHA-256, and it is what official release pages mostly publish. MD5 is still widespread, but collisions can now be constructed for it, so it guards against accidental corruption, not against deliberate tampering. For storing user passwords, neither belongs anywhere near the job: use bcrypt, scrypt or Argon2 — algorithms deliberately designed to be slow and to salt for you.
Timestamps in logs and API payloads come as 10 digits or 13: seconds and milliseconds respectively. Parse milliseconds as seconds and you land fifty thousand years in the future; make the opposite mistake and you land somewhere near 1970. It is the single most common trap here, so the converter reads the unit from the digit count automatically and shows you what it decided, rather than making you choose up front.