Text Hashing & Encryption Toolkit
Generate SHA hashes and HMACs, encrypt text with AES-256-GCM, or transform Hex, URLs and HTML entities—all locally in your browser.
Try it now
Free online toolReady. All conversions run in your browser.
What this tool does
Pick the right operation: hashes verify fingerprints, HMACs authenticate with a shared secret, AES-GCM encrypts and decrypts, while Hex and URL encoding only change representation.
What does each transformation actually do?
Hash: SHA-256, SHA-384 and SHA-512
A cryptographic hash produces a fixed-length fingerprint of text. For example, the SHA-256 hash of abc begins ba7816bf8f01cfea…. Changing one character produces a different fingerprint. A hash is one-way; there is no “decrypt SHA-256” operation. SHA-1 is also available only for legacy interoperability and should not be chosen for new security-sensitive systems.
HMAC-SHA256: a keyed authenticity check
HMAC combines the input and a secret key to produce a message authentication code. Someone who does not know the secret cannot easily forge a matching tag. This is useful when checking webhook signatures and API examples, but exact interoperability depends on encoding and the protocol's canonical message format.
AES-256-GCM: encrypt and decrypt with a password
Choose AES-256-GCM — encrypt, enter your text and a strong password, then run the conversion. You receive a portable v1. token containing the ciphertext plus a random 16-byte salt and 12-byte IV. The password is converted to a key with PBKDF2-HMAC-SHA256 (250,000 iterations); AES-GCM authenticates the encrypted content. Decryption requires the entire token and the same password.
Each encryption uses fresh randomness, so encrypting identical text twice should produce different outputs. Tampered data or a wrong password causes an error. This browser tool is designed for educational use and small text snippets—not to replace audited file encryption, password managers or secure messaging software.
Hex, URL encoding, HTML entities and ROT13
Hex represents UTF-8 bytes in hexadecimal; URL component encoding percent-escapes special characters; HTML escaping turns characters such as < into entities; ROT13 shifts Latin letters by 13 places. All are reversible formatting transformations, not cryptographic protection.
Operations run locally using browser Web Crypto on HTTPS. No input is intentionally uploaded to Vyblet's application server and this page does not load an AdSense script. Never use a weak password, paste production credentials unnecessarily or assume client-side conversion is an audited security product. The browser retains input until you clear it or close the tab.
Frequently asked questions
Can a SHA-256 hash be decrypted?
No. Hashes are one-way fingerprints, unlike AES-GCM ciphertext. If you need reversible encryption, choose the AES-GCM operations instead.
What is the difference between hashing and encryption?
Hashing maps input to a digest and is not normally reversible. Encryption uses a secret key to produce ciphertext that can later be decrypted by an authorized holder of the key.
Why does AES-GCM generate different outputs each time?
It creates a fresh random salt and initialization vector for every encryption. This is expected and essential for safe use of the chosen scheme.
What if I forget the password?
There is no password recovery feature. Keep your password and complete v1. encrypted payload safe. Do not rely on this browser tool as your only backup.
Is MD5 supported?
Not in this tool. MD5 is unsuitable for modern security use, and the browser Web Crypto API does not provide it. Use SHA-256 or stronger for modern hashing tasks.