Hash Generator
MD5, SHA-1, SHA-256, SHA-512 and HMAC — computed in your browser
About this tool
Compute MD5, SHA-1, SHA-256, SHA-384 and SHA-512 digests of any text, plus keyed HMAC signatures, directly in the browser. The SHA family and HMAC use the Web Crypto API — the same audited primitives your browser uses for TLS — while MD5 (which Web Crypto deliberately omits) ships as a small local implementation for legacy checksum work.
Hashes update live as you type, and every algorithm is computed at once, so comparing a value against a checksum in whatever algorithm a download page chose requires no configuration. HMAC mode adds a secret key field for verifying webhook signatures — GitHub, Stripe and most webhook providers sign payloads with HMAC-SHA256.
Since input never leaves the page, it is safe to hash things you could not paste into an online service: API payloads, passwords you are checking against a leaked-hash list, internal documents.
Frequently asked questions
- Which hash algorithm should I use?
- For anything security-relevant today: SHA-256 or stronger. MD5 and SHA-1 are broken for collision resistance — two different inputs can be crafted with the same digest — so they survive only for non-adversarial checksums and legacy protocol compatibility.
- Why is MD5 still offered at all?
- Because you still meet it: ETags, cache keys, file manifests, old database columns. Verifying such values requires computing MD5 regardless of its cryptographic status. Just do not design anything new around it.
- What is HMAC and how is it different from a plain hash?
- HMAC mixes a secret key into the hashing so only key-holders can produce or verify the digest. A plain hash proves integrity ("this data is unchanged"); an HMAC also proves authenticity ("someone with the key produced this"). Webhook signature verification is the everyday use.
- Is hashing the same as encrypting a password?
- No, and fast hashes like SHA-256 are the wrong tool for storing passwords — attackers can try billions per second. Password storage needs a deliberately slow, salted algorithm: bcrypt, scrypt or Argon2.