Hash Generator

A cryptographic hash function takes an input of any length and produces a fixed-size output (the "digest") that is deterministic, fast to compute, and practically irreversible. Even a one-character change in the input produces a completely different digest. Hash functions are used for data integrity verification, digital signatures, password storage, and content addressing.

HMAC (Hash-based Message Authentication Code) combines a cryptographic hash function with a secret key to produce an authentication tag. Unlike plain hashing, HMAC proves both the integrity and authenticity of a message — only someone with the secret key can generate the correct HMAC. Use HMAC for webhook signature verification (GitHub, Stripe, Slack), API request signing, JWT token validation, and any scenario where you need to verify that a message was not tampered with and came from a trusted source.

For security-sensitive tasks such as digital signatures, file integrity, or HMAC authentication, use SHA-256 or SHA-512. MD5 and SHA-1 are cryptographically broken (vulnerable to collision attacks) and should only be used for non-security purposes like checksums for accidental corruption detection or legacy system compatibility.

When you upload a file, the browser reads its raw bytes using the File API (file.arrayBuffer()), then passes the binary data to crypto.subtle.digest() which computes the SHA hash. The file never leaves your computer — no upload occurs. This produces the same checksum as running shasum or sha256sum on the command line, making it ideal for verifying downloaded software, firmware, or ISO files.

The Compare section performs a case-insensitive string comparison of two hash values. This accounts for the common case where one tool outputs uppercase hex and another outputs lowercase. Simply paste both hashes and click Compare — you will see a clear match or mismatch result. This is useful for verifying file downloads against published checksums.

MD5 is not safe for cryptographic purposes — practical collision attacks have been demonstrated since 2004. However, MD5 remains useful for non-security checksums: verifying file downloads against accidental corruption, generating cache keys, or matching legacy systems that require MD5. Never use MD5 for password hashing or digital signatures.

Each algorithm produces a different digest size: MD5 outputs 128 bits (32 hex characters), SHA-1 outputs 160 bits (40 hex chars), SHA-256 outputs 256 bits (64 hex chars), and SHA-512 outputs 512 bits (128 hex chars). Longer digests provide stronger collision resistance and are harder to brute-force.

No. Cryptographic hash functions are designed to be one-way — there is no mathematical method to recover the original input from a hash. Attackers may attempt dictionary attacks or rainbow tables against weak inputs like short passwords, which is why password hashing uses specialized algorithms (bcrypt, Argon2) with salts and iteration counts.

Yes. All computations (SHA digests, HMAC signatures, and file hashes) run entirely in your browser using the native Web Crypto API and local JavaScript. No data — text, secret keys, or file contents — is transmitted to any server, stored in any database, or logged anywhere. This makes it safe to hash sensitive strings like API keys, tokens, passwords, and confidential files.

Yes, for identical input the hexadecimal output matches shasum, sha256sum, openssl dgst, and similar utilities. For HMAC, the output matches openssl dgst -hmac. Note that command-line tools reading files may include a trailing newline character, so ensure your inputs match exactly when comparing digests.