Hash Generator
Generate MD5, SHA-1, SHA-256, SHA-384 and SHA-512 digests of any text or file — in hex or Base64, keyed with HMAC if you need it, and comparable against a published checksum. Everything is computed in your browser.
Text to hash
Hashes
Enter some text to generate its hashes.
What you can do
- See every digest at once. All five algorithms update as you type, so you never have to pick first.
- Hash files too. Drop in a download and check it against the checksum the publisher listed.
- Choose your encoding. Hex for checksums, Base64 for headers and config files.
- Sign with a key. HMAC-SHA256 and friends for API request signing and webhook verification.
- Know what is safe. Algorithms that are broken for security use are labelled as such.
A note on MD5 and SHA-1
Both are included because real systems still use them for file checksums and legacy integrations, and you sometimes need to reproduce one. Neither should be used where an attacker could benefit from two inputs sharing a digest — collisions for both are practical to construct today. Reach for SHA-256 unless something outside your control requires otherwise.
Frequently asked questions
Is my text or file uploaded?
No. Hashing runs in your browser — the SHA family through the built-in Web Crypto API and MD5 through a local implementation — so nothing you enter, and no file you select, leaves your device.
Which hash should I use?
For anything security-related, use SHA-256 or stronger. MD5 and SHA-1 are both broken: it is practical to construct two different inputs with the same digest, so they must not be used for signatures, passwords or integrity against a motivated attacker. They remain fine for non-adversarial checks such as matching a download against a published checksum.
Can I hash passwords with this?
No — and no general-purpose hash should be used for passwords. Plain MD5, SHA-1 or SHA-256 are far too fast, which makes guessing cheap. Passwords need a deliberately slow, salted algorithm such as bcrypt, scrypt or Argon2.
How do I verify a file checksum?
Switch to File, choose the downloaded file, then paste the checksum published by whoever distributed it into the “Compare with” box. The tool tells you which algorithm it matches, or that it matches none of them.
What is HMAC and when do I need it?
HMAC combines a hash with a secret key, so only someone holding the key can produce or check the digest. It is what you want for signing API requests or webhooks — a plain hash proves the data is unchanged, but an HMAC also proves who produced it.
Why is MD5 missing in HMAC mode?
HMAC here is provided by the browser’s Web Crypto API, which offers the SHA family only. Rather than quietly returning an unkeyed digest, MD5 is hidden while HMAC is on.
Need integrations built securely?
AgileTechForge builds web platforms, mobile apps and ERP systems, including the signed APIs and webhooks that hold them together.
Talk to our team