Security

No. These tools are JavaScript running in your browser, so the value you type is processed on your own device and never transmitted. You can confirm it: load the page, disconnect from the internet, and every tool here still works.

No. Hashing is one-way by design: the same input always produces the same hash, but the hash carries no path back. Any site advertising a "hash decrypter" is either looking your hash up in a table of precomputed common values or brute-forcing guesses until one matches. If you do not know which algorithm produced a hash, the hash identifier will narrow it down from the length and format.

Not for anything security-related. Practical collision attacks exist for both — MD5 has been broken since 2004, and SHA-1 fell to the SHAttered attack in 2017 — meaning an attacker can craft two different inputs with the same hash. They remain fine as fast checksums for detecting accidental corruption or duplicate files. For signatures, certificates or anything an adversary might attack, use SHA-256 or SHA-512.

bcrypt, not SHA-256. SHA algorithms are built to be fast, and speed is exactly what helps an attacker who has stolen your database: a modern GPU tries billions of SHA-256 guesses per second. bcrypt is deliberately slow and salts each password, so identical passwords produce different hashes and offline cracking becomes expensive. Use the bcrypt verifier to check a password against an existing hash.

No, and they are not meant to be. These are classical ciphers, breakable with pen and paper — ROT13 can be read by eye once you recognise it. They are here because CTF challenges, puzzle games and obfuscated strings still use them constantly. For real encryption, use AES.