Which key or hash tool do I need
| Your task | Tool |
|---|---|
| Read a certificate: names, expiry, fingerprints | Certificate decoder |
| Check a CSR before sending it to a CA | CSR decoder |
| Convert between text PEM and binary DER | PEM to DER, DER to PEM |
| Fingerprint or convert an SSH public key | SSH key fingerprint |
| SHA-256 of text or a file, in hex and Base64 | SHA-256 in Base64 |
| Content-MD5 and legacy checksums | MD5 in Base64 |
| Sign a webhook or API request | HMAC generator |
integrity="sha384-…" for a script or stylesheet | SRI hash generator |
| A random Base64 string of any length | Random Base64 generator |
Laravel APP_KEY, AES keys, JWT and HMAC secrets | Base64 key generator |
| A nonce for a Content Security Policy | CSP nonce generator |
| Encrypt or decrypt text with a password | AES encrypt, AES decrypt |
Where Base64 meets cryptography
PEM is Base64 of DER-encoded ASN.1 between -----BEGIN …----- lines. Certificates, CSRs, public and private keys all use it. Base64 DER starts with MII for most certificates and RSA keys, MFkw for EC P-256 public keys and MCowBQYDK2Vw for Ed25519 public keys, so the type is often visible before decoding.
SSH keys use a different structure. The AAAAC3NzaC1lZDI1NTE5… part of an ssh-ed25519 line is Base64 of the key blob, and the familiar SHA256:… fingerprint is the Base64 hash of that blob without padding.
Hashes are raw bytes. A SHA-256 of the text hello is 32 bytes: 2cf24dba…9824 as 64 hex characters, or LPJNul+wow4m6DsqxbninhsWHlwfp0JecwQzYpOLmCQ= as 44 Base64 characters. Webhook signatures, SRI attributes and S3 Content-MD5 headers expect the Base64 form, and comparing it with a hex digest is a common source of “signature mismatch” errors.
Random secrets in config files are usually 32 random bytes in Base64, for example openssl rand -base64 32. The key generator produces the same format with presets for common frameworks.
What these tools do not do
- They do not verify certificate chains or check revocation. The page cannot connect to other servers, by design.
- They do not display private key material. The certificate tools show only a private key’s type and size, and the SSH tool reads just the public part of a private key file.
- MD5 and SHA-1 are offered for compatibility with existing systems. Do not use them for new security designs.
For JWT signing and verification, see the web and token tools. To understand why none of this Base64 is a secret by itself, read encoding vs encryption.
FAQ
Why are hashes and keys so often written in Base64?
Because it is shorter than hex. A SHA-256 hash is 64 hex characters but 44 in Base64, and a 32-byte key needs 44 Base64 characters instead of 64. SRI attributes, SSH fingerprints, HMAC signatures and most .env secrets use it for that reason.
Is Base64 a form of encryption?
No. Base64 is reversible by anyone. A PEM private key is just Base64 of the key bytes, which is why the file itself must be protected. Actual encryption, as in the AES tool, needs a key or password to undo.
Are the random keys secure?
They come from the browser’s crypto.getRandomValues, the same cryptographically secure source WebCrypto uses for keys. Nothing is stored or sent, so each value exists only on your screen until you copy it.