TASK

Securely wipe sensitive data from memory

Cryptographic keys and plaintext must be zeroed from memory after use. Learn why memset is not enough and how to prevent compiler optimization.

1

After using a cryptographic key or plaintext, it must be overwritten with zeros in memory. Simply letting the variable go out of scope is insufficient — the data remains in memory until the page is reused. The challenge: compilers optimize away memset(key, 0, len) if the key is never read again.
2

Hash Calculator →
Hash sensitive data before processing if you need to retain a non-reversible representation. The hash output replaces the plaintext in memory — the original is wiped after hashing.
3

Base64 Encoder →
Encode sensitive data for transmission, then wipe the original plaintext from memory. The encoded form is not the secret — it is the transport representation. Wipe both after use.
4

In C/C++, use explicit_bzero() or a volatile pointer to prevent the compiler from optimizing away the zeroing. In JavaScript, the language does not guarantee memory zeroing — use Uint8Array and overwrite all bytes, but be aware the GC may not immediately reclaim the memory. For truly sensitive operations, use a Web Worker and terminate it after use.

Frequently asked questions

Why does the compiler optimize away memset?: If the compiler sees that the buffer is never read after memset(buf, 0, len), it considers the zeroing a "dead store" and removes it for performance. Functions like explicit_bzero use volatile semantics to prevent this optimization.
Is this relevant in JavaScript?: JavaScript strings are immutable and cannot be zeroed — avoid storing secrets in strings. Use Uint8Array (mutable) and overwrite all bytes. However, the GC may copy data during compaction, leaving copies in memory. For maximum security, use a Worker and terminate it, or use WASM with manual memory management.

Workflows that solve this

Convert Ascii85 to Base64

Decode Ascii85 and re-encode as Base64 for wider compatibility.

Convert Base2048 to Base64

Decode Base2048 (emoji) and re-encode as Base64 for standard transport.

Convert Base32 to Base64

Decode a Base32-encoded string into raw bytes and re-encode as Base64 for more compact representation.

Convert Base58 to Base64

Decode Base58 and re-encode as Base64 for standard compatibility.

Base64 encode then decode round-trip

Encode text to Base64 and decode it back to verify the round-trip preserves the original data.

Blowfish Encrypt then Base64

Blowfish encrypt then Base64-encode for text-safe transport.

DES Encrypt then Base64

DES encrypt then Base64-encode for legacy compatibility.

Encode a JSON payload for URL transport

Prepare a JSON document for a URL parameter: pretty-print, Base64-encode, then percent-encode — the exact inverse of the nested-parameter decode chain.

AES encrypt then Base64 encode

Encrypt plaintext with AES and encode the ciphertext as Base64 for text-safe transport.

Hash content and encode as Base64

Compute a hash of the input and encode the hash digest as Base64 for compact transport.

Hash text and verify integrity

Compute a hash of the input text and compare it against an expected hash to verify integrity.

Hash text and verify with CRC32 checksum

Compute both a cryptographic SHA-256 hash and a CRC32 checksum for data integrity verification.

Convert Hex to Base64

Decode a hexadecimal string into raw bytes and re-encode it as Base64 for compact transport.

HMAC Sign then Base64 Encode

Generate HMAC signature then Base64-encode for API auth headers.

MD5 Hash then Base58 Encode

Compute MD5 hash then encode as Base58 for compact representation.

Morse Encode and Base64 Transport

Encode text as Morse code then Base64-encode for digital transport.

Multi-hash speed comparison

Hash the input and benchmark multiple hash algorithms to compare their speed and output.

Generate Password and Hash

Generate a random password then hash it for secure storage.

RC4 Encrypt then Base64

RC4 encrypt then Base64-encode for transport.

RIPEMD-160 Hash then Base64

Compute RIPEMD-160 hash then Base64-encode for transport.

SHA3-256 Hash with CRC32 Checksum

Compute SHA3-256 hash then CRC32 checksum for dual integrity verification.

SHA-512 Hash then Hex Encode

Compute SHA-512 hash then encode as hex for readability.

Reverse Text and Hash

Reverse text then compute SHA-256 hash of the reversed result.

Scramble Text and Hash

Scramble text then hash the scrambled result.

Shuffle Text and Base64 Encode

Shuffle text characters then Base64-encode the result.

Unicode Escape and Base64 Encode

Unicode-escape text then Base64-encode for ASCII-safe transport.

URL Encode then Base64 Double Encode

URL-encode then Base64-encode for double encoding in API payloads.

UUencode then Base64

UUencode text then Base64-encode the result for double encoding.

Generate UUID and Base64 Encode

Generate a UUID then Base64-encode it for compact storage.

Learn more

Want to understand why?

Choosing a hash algorithm: digests, password hashing, and MACs are three different jobs

A field guide to SHA-2, SHA-3, BLAKE2, MD5, bcrypt/Argon2, and HMAC — which one fits integrity checks, password storage, and message authentication, and why they are not interchangeable.

Comparing Hash Algorithms

Compare MD5, SHA-1, SHA-256, SHA-3, and BLAKE2/3 in terms of speed, security, and use cases.

ACID is the four guarantees of transactions: atomicity, consistency, isolation, and durability, ensuring reliable transaction processing.

Adler-32 is a 32-bit checksum designed by Mark Adler; faster to compute than CRC32 but slightly weaker at error detection, used for zlib compression stream integrity.

Related tools

Hash Calculator

Compute MD5, SHA-1, SHA-256, or SHA-512 hashes with hex or Base64 output. Free, private, and 100% client-side.

Encode text or binary data to Base64 online. Free, private, and 100% client-side.

Encrypt text or binary data with AES (CBC/GCM/ECB) using Web Crypto API. Free, private, and 100% client-side.