Message

SHA-1/256/384/512 use the native Web Crypto API. MD5 is computed in pure JavaScript. No data leaves your browser.

About This Tool

This tool computes cryptographic hash digests and HMAC signatures directly in your browser using the Web Crypto API. Supported algorithms include MD5, SHA-1, SHA-256, SHA-384, and SHA-512. MD5 and SHA-1 are legacy algorithms useful for checksums and file verification; for security-critical applications always use SHA-256 or higher. HMAC (Hash-based Message Authentication Code) uses a secret key alongside the hash to verify both data integrity and authenticity, commonly used in API signatures and JWT tokens.

How to Use

Type or paste your text into the input field.
Select the hash algorithm from the dropdown (SHA-256 recommended for most uses).
For HMAC, enable the HMAC toggle and enter your secret key.
The hash updates in real time. Copy the hex digest with one click.

Frequently Asked Questions

What is the difference between SHA-256 and MD5?

SHA-256 produces a 256-bit digest and is cryptographically secure. MD5 produces a 128-bit digest and has known collision vulnerabilities, meaning two different inputs can produce the same hash. Use MD5 only for non-security purposes like checksums. Use SHA-256 or SHA-512 for passwords, digital signatures, and integrity verification.

What is HMAC used for?

HMAC (Hash-based Message Authentication Code) combines a hash function with a secret key to produce a signature. It's widely used in API authentication (HMAC-SHA256 for AWS signatures), webhook verification, and JWT (JSON Web Token) signing to ensure a message hasn't been tampered with.

Is my data sent to a server?

No. All hashing runs in your browser via the Web Crypto API. Your input text and HMAC keys are never transmitted anywhere. The page works fully offline once loaded.

Why does changing one character completely change the hash?

This is called the avalanche effect, a design requirement of every cryptographic hash function. Flipping a single bit in the input should flip roughly half the bits in the output digest, with no visible pattern connecting the two. It's what makes hashes useful for detecting even the smallest change to a file or message, and why you can't guess anything about the input from a partial match on the output.

Can I use this to check if two files are identical without opening them?

Yes. Hash both files with SHA-256 using the File Hash tab. If the digests match exactly, the files are byte-for-byte identical, this is faster and more reliable than a manual diff for large files, backups, or verifying a transfer completed without corruption.

Common Use Cases

Verifying a download. Publishers of Linux ISOs, installers, and open-source releases often publish a SHA-256 checksum next to the download link. Hash the file you downloaded and compare it character by character. A mismatch means the file is corrupted or, in rare cases, tampered with.
Testing webhook signature verification. Services like Stripe and GitHub sign webhook payloads with HMAC-SHA256 using a shared secret. Paste a sample payload and your webhook secret into the HMAC tab to confirm your server-side verification code produces the same signature before you go live.
Checking a suspected password leak. If you find a hash in a breach dump and want to know whether it corresponds to a specific plaintext password you suspect was reused, hash that plaintext with the same algorithm and compare.
Confirming a backup or transfer completed cleanly. Hash the original file and the copy. If the SHA-256 values match, the copy is bit-for-bit identical, even a single dropped byte during an FTP transfer will produce a completely different hash.
Signing legacy API requests. Some older REST APIs still require an HMAC-SHA1 or HMAC-SHA256 signature in a custom header. Generate the signature here to sanity-check your integration code against the documentation's worked example.

MD5 vs SHA-256: Which Should You Use?

MD5 is fast and produces a short 128-bit digest, which is why it's still common for non-security checksums like verifying a file downloaded correctly. It is not safe for anything security-related: researchers have demonstrated practical collision attacks, meaning an attacker can craft two different files that produce the identical MD5 hash. SHA-256 produces a 256-bit digest, has no known practical collision attack, and is the current baseline for password hashing inputs, digital signatures, TLS certificates, and blockchain applications. As a rule of thumb: use MD5 or SHA-1 only for quick integrity checks where nobody is actively trying to fool you, and use SHA-256 or SHA-512 for anything where a malicious actor might benefit from forging a match.

Troubleshooting

My hash doesn't match another tool's output. The most common cause is a trailing newline or extra whitespace, many text editors silently add a newline at the end of a saved file, which changes the hash of that file entirely. Also check character encoding: hashing the same text as UTF-8 versus UTF-16 produces different byte sequences and therefore different hashes.
The file hash changed after I "didn't touch" the file. Some editors rewrite file metadata, line endings (CRLF vs LF), or re-save with a different encoding even without visible content changes. Any of these alters the hash because hashing operates on raw bytes, not on how the content looks.
My HMAC signature doesn't match what the server generated. Confirm you're hashing the exact same byte sequence the server sees, for JSON payloads this often means matching key ordering and whitespace exactly, since re-serializing JSON can change the string even though the data looks the same. Also confirm both sides are using the same hash algorithm (SHA-1 vs SHA-256 signatures look similar in length category but never match each other).
My browser or a scanner flags MD5 as insecure. That warning is expected and correct for security use cases. It does not mean the checksum output is wrong, MD5 is simply unsuitable where someone might deliberately try to forge a matching hash.

Hash & HMAC Generator