Developer tool
Hash Generator
Generate MD5, SHA-1, SHA-256, SHA-384 and SHA-512 hashes or HMACs for text or a file, entirely in your browser with WebCrypto, with hex or Base64 output.
Free, no sign-up. Runs in your browser; nothing is uploaded.
Input
Hashes
Enter text or choose a file to see the hashes.
MD5 and SHA-1 are broken for security use. Use them only for checksums and compatibility; choose SHA-256 or better for anything that matters.
How to use the hash generator
Hashes and HMACs for text and files
A hash turns any input into a fixed-length fingerprint. Change one character and the whole fingerprint changes. That makes hashes useful for checking that a file arrived intact, comparing data without revealing it and building signatures. This tool computes the common ones in one go, in your browser.
Using it
Type or paste text, or switch to File and choose one. All five algorithms update together: MD5, SHA-1, SHA-256, SHA-384 and SHA-512. Choose uppercase hex or Base64 output if the system you are working with expects it, then copy any line.
Text is hashed as UTF-8 bytes exactly as typed, including spaces and line breaks. If a hash does not match another system, look for a trailing newline or different line endings first.
HMAC mode
Tick "HMAC with a secret key" and enter a key. The tool then shows HMAC-SHA-256, HMAC-SHA-512 and so on. HMAC is what most webhook providers use: the sender signs the request body with a shared secret and you recompute it to check the message is genuine and unchanged. Compare the result with the signature header using a constant-time comparison in your own code.
Which algorithm should I use?
- SHA-256 is the sensible default for checksums, integrity checks and signatures.
- SHA-512 is similar in strength and can be faster on 64-bit machines.
- SHA-1 and MD5 are broken for security and kept only for compatibility, for example with old package indexes or cache keys.
- Password storage needs a purpose-built slow function such as Argon2, scrypt or bcrypt, not any plain hash.
Verifying a download
Select the file, copy the SHA-256 line and compare it character by character with the value the publisher lists. If they differ, download again from the official source.
Privacy
Files and text never leave your device. The page does not send them to a server, and the hashing happens locally using the browser WebCrypto API plus a small built-in MD5 routine.
Frequently asked questions
Is MD5 safe to use?
Not for security. MD5 and SHA-1 have known collision attacks, so do not use them for passwords or signatures. They are fine for quick checksums and for matching legacy systems.
Can I hash passwords with this?
A plain hash is the wrong tool for storing passwords, because it is fast to guess against. Use a slow password hash such as Argon2, scrypt or bcrypt on your server.
What is an HMAC?
A hash that also mixes in a secret key, so only someone with the key can produce or check it. It is used to sign webhooks and API requests.
Can I verify a downloaded file?
Yes. Choose File, select it, and compare the SHA-256 shown with the checksum the publisher lists. Files up to 300 MB are supported; they are read locally and never uploaded.
Why does my hash differ from another tool?
Usually a hidden character: a trailing newline, different line endings or a different text encoding. This tool hashes the UTF-8 bytes of exactly what is in the box.
How is MD5 done without WebCrypto?
Browsers deliberately leave MD5 out of WebCrypto, so a small MD5 routine is built into the page. SHA hashes use the native browser implementation.