Skip to content
bobob

Hash Generator

Generate MD5, SHA-1, SHA-256, SHA-512, HMAC signatures, and a safe signature report locally.

Runs in your browserNothing you type is sent to a server.

Input and result

What you type is kept in this browser only. Reopen to restore your last run.

Use cases

  • Generate repeatable hashes for checksums and debugging
  • Create HMAC SHA-256 signatures for webhook tests
  • Copy a safe signature report without raw input or secrets
  • Compare SHA-256 or SHA-512 digests after normalizing input

Examples

Common input
hello world
Generate repeatable hashes, HMAC signatures, and a handoff report for checksums, webhook tests, and debugging.
Typical output
SHA-256: b94d27b9934d3e08... / HMAC-SHA-256: ... / signature report
Use this as a quick sanity check before copying results.
Artifact checksum
release-v1.2.3.tar.gz
Generates a digest and a compact checksum report to compare with build or release notes.
Webhook HMAC draft
{"event":"payment.created","id":"evt_123"}
Pairs with an HMAC secret for local webhook signature testing and a safe handoff report.

Common mistakes

  • Hashes are not encryption and should not be used as password storage by themselves.
  • Hidden newlines, spaces, or Unicode normalization change the resulting hash.
  • MD5 and SHA-1 are weak for security-sensitive integrity checks.
  • HMAC signatures are only useful when the shared secret is kept private.

Before you copy

  1. 1Normalize the input text exactly as the target system will read it.
  2. 2Choose SHA-256 or SHA-512 for modern checksum work unless compatibility requires another algorithm.
  3. 3Use HMAC mode when comparing webhook signatures or keyed API payloads.
  4. 4Compare the full hash, not only a short prefix, before trusting the result.

Sources

  • Do not start new work on MD5 for security

    RFC 6151 documents that collision attacks on MD5 are practical and advises against new use where signatures or integrity matter. What is left are uses with no adversary, such as finding duplicate files.

    Basis: RFC 6151

  • SHA-2 output lengths are fixed by the standard

    FIPS 180-4 fixes SHA-256, SHA-384 and SHA-512 at 256, 384 and 512 bits. The same input must give the same digest in any implementation, so a mismatch means your input differs - encoding, or a trailing newline.

    Basis: FIPS 180-4

  • Passwords are stored with a key derivation function, not a hash

    NIST SP 800-63B requires stored password verifiers to use a salted, deliberately slow key derivation function. A single pass of SHA-256 is fast enough that a leaked table falls to bulk guessing.

    Basis: NIST SP 800-63B

FAQ

Does Hash Generator upload my input?

No. This tool runs in your browser unless the privacy badge explicitly says a server route is required.

Can I use this for production secrets?

Avoid pasting sensitive production data into any website. Prefer local test data or redacted payloads.

Is a hash the same as encryption?

No. Hashes are one-way digests. They do not protect the original text from guessing if the input is weak or known.

Which hash should I choose?

Use SHA-256 or SHA-512 for modern checksum work. Use HMAC when you need a keyed signature such as a webhook verification value, then copy the signature report without sharing the secret.