Hash Generator
Compute MD5, SHA-1, SHA-256, SHA-384, and SHA-512 hashes of text or files. Also supports HMAC.
Generate MD5, SHA-1, SHA-256, SHA-512, and HMAC hashes in your browser
Hash functions condense any input into a fixed-length fingerprint. They are used for file integrity checks, deduplication, content addressing, signatures, password storage scaffolding, and cache keys. This page lets you hash text or arbitrary input with the algorithms most often required by APIs, build pipelines, and security tooling, all without uploading the content anywhere. Each algorithm has a different speed, output size, and security posture, so the guidance below explains when each one is the right choice.
- Paste or type the input you want to hash. Whitespace and line endings are part of the data, so be careful not to introduce trailing newlines.
- Pick the algorithm your downstream system expects. SHA-256 is a safe default for new work; MD5 and SHA-1 are still useful for compatibility but should not be used for security.
- For HMAC, supply the shared secret exactly as it appears in the consumer system, including any encoding it requires.
- Copy the resulting digest and compare it to the expected value or send it to the API that needs it.
What hashes are good at and what they are not
Hashes are excellent for integrity checks, content addressing, cache keys, deduplication, HMAC signing, and build fingerprints. Their strength is that even a one-byte change in the input produces a completely different digest.
A hash is not encryption, though, and it does not prove authorship by itself. Without a shared secret or signature system, a digest only tells you whether content matches a known version, not who created it.
Why password storage needs more than SHA-256
Password storage is where generic hash tools are most often misunderstood. Developers know SHA-256 is newer than MD5 and assume that means it is fine for passwords. The problem is speed: fast hashes are exactly what attackers want during offline cracking.
For passwords, use a dedicated KDF such as bcrypt, scrypt, or Argon2 with a unique salt per user. Keep file integrity and API signing clearly separate from password storage so the two use cases are not confused.
Best use cases
- Computing checksums to verify a file or payload has not been altered in transit.
- Building cache keys or content-addressed identifiers for assets.
- Generating HMAC signatures required by webhooks, payment APIs, and cloud services.
Common mistakes to avoid
- MD5 and SHA-1 are broken for collision resistance. Use them only for non-security tasks like quick checksums.
- Hashing a password without a slow KDF (such as bcrypt, scrypt, or Argon2) and a per-user salt is not secure. Plain SHA-256 is too fast for password storage.
- A single different byte produces a totally different digest, so trim invisible characters carefully when reproducing a value from a spec.
How this tool works
- Implementation
- Web Crypto SubtleCrypto for SHA/HMAC and crypto-js for MD5 compatibility
- Data path
- Input is processed in the current browser tab. Tool input is not submitted to a DevHelper Tools application server.
- Independent check
- Compare the digest with an operating-system or language implementation using identical bytes and encoding.
Verify before production use
A successful conversion or generated snippet is not proof that it matches your runtime. Check the output against an independent implementation, test one known edge case, and record the environment or standard version you validated.
Related tools
Move directly into the next step instead of leaving the site to do adjacent work elsewhere.
AES Encryption / Decryption
Encrypt and decrypt text using AES encryption
JWT Decoder & Security Auditor
Decode and inspect JSON Web Tokens with client-side security checks for none algorithm, expiry, audience, issuer, and risky claim setups.
UUID / ULID Generator
Generate UUIDs (v1, v4, v7) and ULIDs in bulk. UUID v7 is timestamp-prefixed and lexically sortable β great for database keys.
Base64 Encoder / Decoder
Encode and decode text or files using Base64 encoding
FAQ
Which algorithm should I use for new code?
SHA-256 is a strong default. Use SHA-512 when you want a wider digest, and HMAC-SHA-256 when you need an authenticated signature with a shared secret.
Can I hash a file directly?
This tool focuses on text input. For very large files, use your operating system shasum/certutil commands or a streaming script to avoid loading the entire file into memory.
Is the input sent to a server?
No. The hashing is performed in your browser through crypto-js, so the input and output stay on your device.