Password Encryption Utility

Hashing vs. encryption

This tool is often searched for as "password encryption," but what it actually produces are cryptographic hashes (MD5, SHA-1, SHA-256, SHA-512) plus a Base64 encoding - and the distinction matters. A hash is one-way: there's no key that turns it back into your original text, which is exactly what you want when checking data integrity or comparing values without storing the original. Base64, by contrast, is reversible encoding (not encryption at all) - anyone can decode it back to the original text instantly, so it should never be used to protect anything sensitive. Real encryption (like AES) uses a secret key and is reversible only with that key; this tool doesn't perform that kind of encryption. Everything below runs locally in your browser.

Why plain hashing isn't safe for real password storage

Feeding a password directly through MD5 or SHA-256 and storing the result is a well-known mistake - these algorithms are designed to be fast, which means an attacker with a leaked hash database can try billions of guesses per second against them. Dedicated password-hashing algorithms (bcrypt, scrypt, Argon2) are deliberately slow and incorporate a unique random "salt" per password specifically to make that kind of brute-force attack impractical, which general-purpose hash functions like these don't provide.

Why multiple hash algorithms are shown side by side

MD5 and SHA-1 are now considered cryptographically broken for security purposes (though still used for non-security checksums), while SHA-256 and SHA-512 remain considered secure for general hashing needs - showing all four side by side makes it easy to compare output length and format across algorithms, or to match whatever specific hash format an existing system expects.

Why Base64 is included even though it offers no security

Base64 is included here because it's commonly searched for alongside hashing, even though it serves a completely different purpose: safely representing arbitrary binary data as plain text characters for transmission or storage, with zero security benefit since decoding it back requires no key at all.

Ofte stilte spørsmål

Which of these should I use to actually store passwords?

None of them, directly - production systems should use a dedicated password-hashing algorithm (bcrypt, scrypt, or Argon2) that is deliberately slow and uses per-password salts, which this simple demonstration tool does not add.

Is Base64 a form of encryption?

No - Base64 just re-represents the same data using a different character set. It provides no security at all, since anyone can decode it back instantly; it is useful for safely transmitting binary data as text, not for protecting it.

Why are MD5 and SHA-1 considered broken?

Both have known vulnerabilities that allow attackers to find hash collisions faster than should be possible, which undermines their security for sensitive uses - though they're still fine for non-security tasks like basic file integrity checks.

What makes bcrypt or Argon2 different from the hashes shown here?

They're deliberately slow and add a unique random salt per password, specifically to make large-scale guessing attacks against a leaked database impractical - general hash functions like these are fast, which works against that goal.

Does this tool send my text to a server?

No - everything, including the hashing and encoding, runs directly in your browser using built-in cryptographic functions. Nothing you type here is transmitted anywhere.