Guides

Hash generator security notes

How to use MD5, SHA-1, SHA-256, and SHA-512 outputs without confusing hashing with encryption.

Do not confuse hashing with encryption

A hash is a one-way digest, not a protected version of the original content. It can prove that two inputs match, but it cannot keep a weak or known input secret.

Hashes are useful for checksums and fingerprints.
Hashes do not hide predictable input from guessing.
Encrypted content should be handled by a dedicated cryptographic workflow.

Choose the algorithm for the job

MD5 and SHA-1 remain common for legacy compatibility, but they should not be selected for modern security-sensitive integrity checks. SHA-256, SHA-512, and HMAC variants are usually safer choices for current workflows.

Use MD5 only when a legacy system requires it.
Use SHA-256 or SHA-512 for modern checksum work.
Use HMAC when a shared secret must authenticate a payload.

Normalize input before comparing digests

Whitespace, hidden newlines, Unicode normalization, and file encoding can change the digest completely. If two hashes differ, inspect the exact byte-level input before assuming the algorithm is wrong.

Check trailing newline differences.
Confirm UTF-8 versus other encodings.
Copy the same canonical text representation for comparison.

Treat HMAC secrets carefully

HMAC output is only meaningful when the secret remains private and stable. A browser helper can draft or compare a signature, but production secrets should be handled in your own trusted environment.

Use redacted or test secrets in public tools.
Compare full signatures, not short prefixes.
Keep webhook signing strings exactly as the provider documents them.

Use related tools for transport values

Hash results are often copied into headers, JSON, Base64 transport values, or release notes. Format the surrounding payload and check encoding before sharing the digest as evidence.

Base64 helps inspect encoded webhook pieces.
JSON Formatter helps review signed payload shape.
Text Diff helps compare before-and-after checksum notes.

Before copying

A short review loop for safer reuse

1. Hash GeneratorGenerate MD5, SHA-1, SHA-256, SHA-512, HMAC signatures, and a safe signature report locally.SecurityNext step: Generate repeatable hashes for checksums and debuggingNormalize the input text exactly as the target system will read it.2. Base64 Encoder DecoderEncode, decode, inspect, and copy a safe payload report for Base64, Base64URL, image data URLs, JSON payloads, and JWT segments locally in the browser.DataNext step: Decode copied Base64 payloads from logsChoose encode or decode mode deliberately before pasting the value.3. Random Token GeneratorGenerate secure random hex, Base64, and URL-safe tokens with a safe handoff report.SecurityNext step: Generate local session or refresh tokensCompare the output against the original input before copying.

Hash Generator

Generate MD5, SHA-1, SHA-256, SHA-512, HMAC signatures, and a safe signature report locally.

Security

Use cases

Generate repeatable hashes for checksums and debugging
Create HMAC SHA-256 signatures for webhook tests
Copy a safe signature report without raw input or secrets
Compare SHA-256 or SHA-512 digests after normalizing input

Common failure cases

Hashes are not encryption and should not be used as password storage by themselves.
Hidden newlines, spaces, or Unicode normalization change the resulting hash.
MD5 and SHA-1 are weak for security-sensitive integrity checks.

Before copying

Normalize the input text exactly as the target system will read it.
Choose SHA-256 or SHA-512 for modern checksum work unless compatibility requires another algorithm.
Use HMAC mode when comparing webhook signatures or keyed API payloads.

Examples

Common input

Generate repeatable hashes, HMAC signatures, and a handoff report for checksums, webhook tests, and debugging.

hello world

Typical output

Use this as a quick sanity check before copying results.

SHA-256: b94d27b9934d3e08... / HMAC-SHA-256: ... / signature report

Artifact checksum

Generates a digest and a compact checksum report to compare with build or release notes.

release-v1.2.3.tar.gz

FAQ

Does Hash Generator upload my input?

No. This tool runs in your browser unless the privacy badge explicitly says a server route is required.

Can I use this for production secrets?

Avoid pasting sensitive production data into any website. Prefer local test data or redacted payloads.

Is a hash the same as encryption?

No. Hashes are one-way digests. They do not protect the original text from guessing if the input is weak or known.

Base64 Encoder Decoder

Encode, decode, inspect, and copy a safe payload report for Base64, Base64URL, image data URLs, JSON payloads, and JWT segments locally in the browser.

Data

Use cases

Decode copied Base64 payloads from logs
Copy a Base64 payload report with variant, decoded shape, warnings, and safe handoff checks
Preview and download Base64 image data URLs before copying binary output
Convert text to Base64 for fixtures

Common failure cases

URL-safe Base64 and standard Base64 can differ by padding and character set.
Binary data may not round-trip as readable UTF-8 text.
A JWT payload segment can look like plain Base64 even though it needs token context.

Before copying

Choose encode or decode mode deliberately before pasting the value.
Confirm the decoded text is expected UTF-8, not binary or compressed data.
Use the diagnostics panel to check JSON keys, JWT-like payloads, padding, and control characters.

Examples

Common input

Encode plain text, decode Base64 transport values, inspect decoded shape, and copy a payload report.

hello world

Typical output

Use this as a quick sanity check before copying results.

aGVsbG8gd29ybGQ=

JSON transport value

Detects JSON-shaped decoded output and prepares a compact payload report before sending it to JSON Formatter.

eyJzdGF0dXMiOiJvayIsInNjb3BlIjoicmVhZCJ9

FAQ

Does Base64 Encoder Decoder upload my input?

No. This tool runs in your browser unless the privacy badge explicitly says a server route is required.

Can I use this for production secrets?

Avoid pasting sensitive production data into any website. Prefer local test data or redacted payloads.

Why does decoded Base64 look unreadable?

The decoded bytes may be binary, compressed, encrypted, or not UTF-8 text. Treat unreadable output as a signal, not a failure.

Random Token Generator

Generate secure random hex, Base64, and URL-safe tokens with a safe handoff report.

Security

Use cases

Generate local session or refresh tokens
Create URL-safe CSRF and cookie token fixtures
Produce API key seeds or webhook secrets for development
Check entropy, encoded length, padding, and URL safety before copying

Common failure cases

Random Token Generator can still fail when the pasted input shape differs from 32 bytes URL-safe session token.
The output should be reviewed in the target security workflow before reuse.
Browser-local processing does not make sensitive production data safe to paste.

Before copying

Compare the output against the original input before copying.
Remove secrets, customer data, and one-off environment values.
Continue with password-generator if the result needs another validation step.

Examples

Common input

Create local random secrets, inspect entropy, encoding, URL safety, storage warnings, and copy a safe handoff report.

32 bytes, URL-safe

Typical output

Use this as a quick sanity check before copying results.

URL-safe token / 256 bits entropy / local browser crypto / token report

FAQ

Does Random Token Generator upload my input?

No. This tool runs in your browser unless the privacy badge explicitly says a server route is required.

Can I use this for production secrets?

Avoid pasting sensitive production data into any website. Prefer local test data or redacted payloads.

Related tools

Open the utility connected to this guide.

Hash GeneratorGenerate MD5, SHA-1, SHA-256, SHA-512, HMAC signatures, and a safe signature report locally.Generate repeatable hashes for checksums and debugging · Create HMAC SHA-256 signatures for webhook testsGenerate repeatable hashes, HMAC signatures, and a handoff report for checksums, webhook tests, and debugging.No. This tool runs in your browser unless the privacy badge explicitly says a server route is required.Base64 Encoder DecoderEncode, decode, inspect, and copy a safe payload report for Base64, Base64URL, image data URLs, JSON payloads, and JWT segments locally in the browser.Decode copied Base64 payloads from logs · Copy a Base64 payload report with variant, decoded shape, warnings, and safe handoff checksEncode plain text, decode Base64 transport values, inspect decoded shape, and copy a payload report.No. This tool runs in your browser unless the privacy badge explicitly says a server route is required.Random Token GeneratorGenerate secure random hex, Base64, and URL-safe tokens with a safe handoff report.Generate local session or refresh tokens · Create URL-safe CSRF and cookie token fixturesCreate local random secrets, inspect entropy, encoding, URL safety, storage warnings, and copy a safe handoff report.No. This tool runs in your browser unless the privacy badge explicitly says a server route is required.