Hash & HMAC Generator — MD5, SHA-1 to SHA-512
Generate MD5, SHA-1, SHA-256, SHA-384, SHA-512 hashes and HMAC signatures from text or files. Everything runs in your browser via the Web Crypto API.
How it works
- Hash — one-way function that maps any input size to a fixed-size fingerprint. The same input always produces the same output; tiny input changes produce completely different hashes (avalanche effect).
- HMAC — Hash-based Message Authentication Code. Combines a secret key with the input so that only someone with the key can produce the correct MAC. Used for API signature verification (AWS, Stripe, GitHub webhooks).
- MD5 / SHA-1 are kept for legacy checksums — do not use them for security-sensitive operations.
- All algorithms except MD5 use the browser's native Web Crypto API. MD5 is implemented in pure JS since the spec does not include it.
The keyed half: what HMAC mode changes
In Hash mode this is a plain digest with a single-algorithm selector. Flip Mode to HMAC and a key field appears; the output then comes from `crypto.subtle.sign('HMAC', key, data)`, which is a keyed construction rather than a bare hash. The key is imported with `extractable=false` and `usages:['sign']`, so the raw secret cannot be read back out of the CryptoKey object even in the same page context.
Structurally, HMAC pads the key out to the block size and XORs it into two constants to produce an inner and an outer pad, then computes `H(outer || H(inner || message))`. That nesting is why the output is always exactly as long as the underlying hash no matter how long the message or key is, and why the tag is unforgeable without the secret even though the hash function itself is public.
Where this differs from the plain hash view
Three differences are worth knowing if you use both pages. This one computes one algorithm at a time and you choose which, where the sibling page computes all of them simultaneously. This one outputs hex only. And this one bundles a working MD5 implementation, because Web Crypto has no MD5 — that is a compatibility feature, not an endorsement, so keep confining it to reproducing legacy checksums.
Text is encoded as UTF-8 through `TextEncoder`, and results recompute as you type in Hash mode, which makes the avalanche effect visible as you hold the Shift key: one character in, a completely unrelated digest out. Switching algorithm or mode also recomputes immediately, so you can watch SHA-256 and SHA-512 diverge on identical input rather than taking the difference on faith.
Two caveats in the file path
File input takes the same route as typed text, which is the point: every algorithm, keyed or unkeyed, reads the raw bytes rather than a UTF-8 decoding of them. The distinction is invisible for ASCII and decisive for everything else, because decoding a binary file to text replaces every invalid byte sequence with U+FFFD and produces a digest of the wrong data while looking perfectly successful. SubtleCrypto's digest is a one-shot API rather than a stream, so the whole file is read into memory before hashing; for inputs in the hundreds of megabytes a native command-line tool is the better choice.
One consequence of routing every algorithm through the same byte path is that a loaded file cannot be re-hashed from the input field, because the field holds a description rather than the content. Hashing that description instead would silently produce a digest of a placeholder string, so re-running is a no-op until you load the file again. For the same reason a very large file is held in memory as a single ArrayBuffer; everything smaller is byte-exact.
Frequently Asked Questions
How do I generate a hash from a string?
Is the hashing done locally?
What is the difference between SHA-256 and SHA-512?
Is my data sent to a server?
Do I need an account or API key?
Can I use these tools offline?
All processing happens in your browser. No uploads, no tracking, no servers. Your API keys, configs, and private payloads stay private — 100% client-side.