hash-generator
Type or paste any text — or a file — to instantly compute its MD5, SHA-1, SHA-256, and SHA-512 hash values, plain or as a keyed HMAC. All computation runs locally in your browser — nothing leaves your machine.
When set, all four outputs become a keyed HMAC of the input using that key, instead of a plain hash.
// which algorithm to use
SHA-512 — Same security properties as SHA-256 but produces a 512-bit (128-character hex) output. Useful when you need a longer hash for additional collision resistance, or when hashing large data where SHA-512 is faster than SHA-256 on 64-bit hardware due to word size.
SHA-1 — Deprecated for all security-sensitive purposes since 2017 (collision attacks are practical). Still widely used for non-security checksums (Git commit IDs use SHA-1), and many older systems still emit SHA-1 hashes you may need to verify. Don't use it for new security work.
MD5 — Cryptographically broken since the mid-2000s (deliberate collisions can be constructed in seconds). Exists here for compatibility with legacy systems, checksums, and formats that still emit MD5 hashes (like some database file integrity checks or older package registries). Never use MD5 to protect security-sensitive data.
// hashing vs. encryption — they are not the same thing
A hash is a one-way function: the same input always produces the same output, but you cannot reconstruct the input from the hash. Encryption is two-way: a key encrypts data and a key decrypts it back. If you "hash" a password to store it in a database, that's correct — storing encrypted passwords means you have a key that can decrypt them, which is a security liability. If you need to be able to recover the original value, you want encryption, not hashing.
// how this tool computes the hashes
SHA-1, SHA-256, and SHA-512 are computed via the browser's SubtleCrypto API (crypto.subtle.digest()), which uses the browser's native cryptographic implementation — no third-party library involved. MD5 is not part of the Web Crypto API (it's considered legacy), so this tool uses a pure-JavaScript MD5 implementation. All inputs are UTF-8 encoded before hashing, matching how .NET's Encoding.UTF8.GetBytes() + SHA256.HashData() behaves. Choosing "Hash a file instead" reads the file's raw bytes directly, without any text/UTF-8 step, matching how SHA256.HashData(File.ReadAllBytes(path)) works.
// HMAC (keyed hashing)
A plain hash proves data hasn't changed, but anyone can compute it — it doesn't prove who produced it. An HMAC mixes a secret key into the hash (per RFC 2104), so only someone holding that key could have produced the given output — that's what webhook signature verification (Stripe, GitHub, etc.) and .NET's HMACSHA256 class are for. Filling in the HMAC key field switches all four outputs to this keyed mode; SHA-1/256/512 use crypto.subtle's native HMAC support, and MD5 uses the standard HMAC construction built on the same pure-JS implementation above.
// learn more
For how each algorithm works internally and when to reach for which one, see Hashing Algorithms Explained.
SHA-256 — The right default for almost everything: verifying file integrity, signing tokens, storing password hashes (via a slow KDF like bcrypt, not raw SHA-256), generating content-addressable identifiers. Part of the SHA-2 family, currently unbroken, and what the Web Crypto API and .NET's
SHA256.HashData()expose natively.