Cryptography

Run real SHA-256 and AES-GCM operations from your browser's Web Crypto API on text you type, generate keys safely and see why passwords need a slow, salted hash instead of plain SHA-256.

Encoding changes the format

UTF-8 turns text into bytes; Base64 turns bytes into letters that survive email and URLs. Anyone can reverse both. There is no secret involved.

Hashing makes a fingerprint

SHA-256 turns any input into a 256-bit digest. The same input always gives the same digest, a tiny change gives a completely different one, and it can't be reversed into the input.

Encryption keeps a secret

AES-GCM scrambles a message with a key and a fresh random IV. Only someone with the key can decrypt it, and any change to the ciphertext is detected.

Keys here and keys in production

In this lab a key exists only in this tab's memory and disappears when you leave. Real systems keep keys in a key management service or hardware module, control who can use them, and rotate them.

Plain SHA-256 is fast by design, which is exactly why it must never be used on its own to store passwords.