Hash Generator: MD5, SHA-256, SHA-512 and HMAC

Type or paste text, or choose a file, and the page shows its MD5, SHA-1, SHA-256, SHA-384 and SHA-512 digests side by side. Text is hashed as UTF-8 bytes, so the same string gives the same hash here as in Node.js, Python or sha256sum. SHA-1 and the SHA-2 family come from the Web Crypto API built into your browser; MD5, which Web Crypto deliberately leaves out, comes from the spark-md5 library. Output can be lowercase or uppercase hex, or Base64.

Switch on HMAC mode to compute a keyed hash (RFC 2104). The key can be typed as text or entered as hex bytes, which is how the RFC 4231 test vectors are written. An HMAC proves that whoever made it knew the key, which is why webhook signatures from services such as Stripe or GitHub use it. A plain hash proves nothing about who produced it.

Paste the hash a publisher gave you into the compare box. It accepts hex in any case, with or without colons or spaces, and Base64, and tells you which algorithm matched. The length of a hex string is a good hint: 32 characters is MD5, 40 is SHA-1, 64 is SHA-256, 96 is SHA-384 and 128 is SHA-512. A mismatch means the bytes differ, not that the file is dangerous: a changed line ending, a different encoding or a wrong key gives a completely different hash.

Files are read in 8 MB slices with a progress readout, and MD5 is computed in 1 MB chunks so the page stays responsive. Because SHA through Web Crypto needs the whole message in memory, files are limited to 512 MB. For larger files use sha256sum or Get-FileHash on the command line.

MD5 and SHA-1 are broken for security purposes: attackers can construct two different inputs with the same digest, and a SHA-1 collision was demonstrated publicly in 2017. They remain fine for catching accidental corruption or as cache keys. Do not use them to sign anything. Never store passwords with a plain SHA-256 either; it is built to be fast, which helps an attacker. Use Argon2id, bcrypt or scrypt, which are slow on purpose and salted.

A hash cannot be decrypted. People sometimes look up common hashes in tables of precomputed values, which only works for short, guessable inputs. Nothing you enter here is sent anywhere, but treat a secret key typed into any web page with care and use throwaway keys when you only want to test an implementation.