toolember
Pro
Developer

Hash Generator

Free online hash generator for MD5, SHA-1, SHA-256, and SHA-512, hash text or files directly in your browser. Includes HMAC signing, all-algorithms-at-once view, uppercase toggle, and a verify mode to confirm checksums. Uses Web Crypto API, no data leaves your device.

Enter text or drop a file to generate hash

How the Hash Generator Works

A hash function is a one-way algorithm that turns any input, text or file, into a fixed-length string of hex characters called a hash (or digest). The same input always produces the same hash, and changing even one character produces a completely different result.

Text hashing

Type or paste any text in the input field. The hash is computed in real time (debounced 50 ms) using the browser's built-in crypto.subtle.digest for SHA algorithms and a client-side JS library for MD5. No button press required.

File hashing

Switch to File mode and drag-and-drop any file. The browser reads it as an ArrayBuffer, the raw bytes are hashed directly, so binary files (images, executables, archives) produce the same result as native tools like sha256sum. No size limit beyond available browser memory.

Verify mode

After generating a hash, paste any expected checksum into the Verify field. The tool performs a case-insensitive comparison and immediately shows a green MATCH or red NO MATCH badge, useful for confirming ISO images, software downloads, or API response integrity.

HMAC signing

Enable HMAC mode and enter a secret key to produce a keyed hash. The tool uses crypto.subtle.importKey + crypto.subtle.sign with the selected SHA algorithm. HMAC-SHA256 is the most widely supported variant for API authentication.

Supported Hash Algorithms

MD5, 128-bit / 32 hex chars

Fast but cryptographically broken since 2004. Acceptable for non-security checksums and legacy systems. Do not use for passwords or digital signatures.

SHA-1, 160-bit / 40 hex chars

Deprecated by NIST starting in 2011; collision attacks demonstrated in 2017 (SHAttered). Use only for legacy protocol compatibility such as older Git objects.

SHA-256, 256-bit / 64 hex chars

Current industry standard. Used in TLS 1.3, Bitcoin, AWS Signature V4, code signing certificates, and most modern security protocols. Recommended for new work.

SHA-512, 512-bit / 128 hex chars

Larger output; faster than SHA-256 on 64-bit CPUs due to 64-bit word operations. Ideal for high-security applications, long-term archiving, and situations where collision resistance headroom matters.

Common Use Cases

File integrity verification: Download an ISO or release binary, then compare its SHA-256 hash against the publisher's checksum using the Verify field to confirm the file was not corrupted or tampered with in transit.
API request signing: Use HMAC-SHA256 to sign API payloads with a shared secret. This is how AWS Signature V4, Stripe webhooks, and GitHub webhook payloads are authenticated.
Data deduplication: Generate SHA-256 hashes of files or content blocks to identify duplicates without comparing byte-by-byte, the foundation of content-addressable storage systems like Git and IPFS.
Digital forensics: Hash evidence files before and after analysis to prove a chain of custody and demonstrate data has not been altered during an investigation.
Cache key generation: Hash a request body or configuration object to produce a deterministic cache key. MD5 is acceptable here since collision resistance is not needed.

Security Best Practices

Password storage: Never store raw MD5, SHA-1, or SHA-256 hashes of passwords. Use a purpose-built password hashing function instead:

  • bcrypt, widely supported, adaptive cost factor, good default choice
  • Argon2id, winner of the 2015 Password Hashing Competition; best current choice
  • scrypt, memory-hard; good for environments where Argon2 is unavailable

Checksum verification: Always obtain expected hashes over HTTPS from the same source as the file to prevent man-in-the-middle substitution.

The avalanche effect: why one letter changes everything

A good hash function is designed so that changing a single bit of input flips roughly half the output bits, with no visible pattern connecting the two results. Try it yourself in the tool above: hashinghelloandHellowith SHA-256, a single capitalized letter, produces two completely unrelated 64-character outputs:

  • SHA-256("hello")

    2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824

  • SHA-256("Hello")

    185f8db32271fe25f561a6fc938b2e264306ec304eda518007d1764826381969

This is exactly why hashes work as tamper detectors: there is no way to predict how a change to the input will alter the output, so any modification, even swapping one character, is immediately visible when the hash no longer matches.

Frequently Asked Questions

What is a hash function?▾
A hash function is a mathematical algorithm that converts input data of any size into a fixed-length string. The same input always produces the same hash, but even a single character change creates a completely different result. Hash functions are one-way, you cannot reverse a hash to recover the original input.
What is the difference between MD5, SHA-1, SHA-256, and SHA-512?▾
MD5 produces a 128-bit (32-character hex) hash and is cryptographically broken, use it only for checksums. SHA-1 produces 160 bits and is deprecated. SHA-256 (256-bit) and SHA-512 (512-bit) belong to the SHA-2 family and remain secure for cryptographic use. For anything security-sensitive, always choose SHA-256 or SHA-512.
How do I use the verify / compare mode?▾
Enter your text or file, then paste the expected hash into the "Verify Hash" field at the bottom of the tool. The tool instantly shows a green MATCH or red NO MATCH badge, useful for confirming a download's checksum or verifying file integrity without leaving the browser.
What is HMAC and when should I use it?▾
HMAC (Hash-based Message Authentication Code) combines a cryptographic hash with a secret key to verify both data integrity and authenticity. Unlike a plain hash, HMAC proves the message came from someone who knows the key. It is widely used in API request signing, webhook verification, and JWT token generation.
Can I hash files without uploading them?▾
Yes. Switch to File mode, then drag and drop any file into the tool. Hashing is performed entirely inside your browser using the Web Crypto API and the js-md5 library. No data is transferred to any server at any point, not even metadata like the filename.
Can I reverse a hash to get the original text?▾
No. Hash functions are one-way by design. However, simple or common passwords can sometimes be cracked with rainbow tables, precomputed lists of hash-to-password pairs. This is why passwords must always be stored using a slow, salted algorithm like bcrypt, scrypt, or Argon2, never with raw MD5 or SHA-256.
What does "show all algorithms at once" do?▾
Selecting "All at Once" mode generates MD5, SHA-1, SHA-256, and SHA-512 hashes simultaneously from the same input. This is useful when you need to compare outputs across algorithms or provide multiple checksums for a file distribution. Each result has its own copy button.
Which hash algorithm should I use for my project?▾
SHA-256 is the standard choice for most applications, TLS certificates, code signing, blockchain, and API authentication all use it. SHA-512 offers a larger output and better theoretical resistance on 64-bit systems. MD5 and SHA-1 are only appropriate for non-security purposes such as cache keys or legacy file checksums.
Why does the same password produce a different hash each time on real websites?▾
Properly implemented password storage adds a unique random value called a salt before hashing. The salt is stored alongside the hash so the password can still be verified, but two users with the same password will have different stored hashes. This tool generates raw, unsalted hashes, do not use them directly for password storage.
Are my inputs and files private?▾
Yes. All computation runs entirely in your browser. No text, files, or results are sent to any server, logged, or stored. The page uses the browser's built-in Web Crypto API for SHA hashes and a client-side JavaScript library for MD5. Closing or refreshing the page clears everything.

By Toolember · Updated September 2026