Generate MD5, SHA-1, SHA-256 and SHA-512 hashes or keyed HMAC signatures from any text, with instant comparison, uppercase toggle and fast offline computation.
Part of our Developer Tools collection — Explore more Developer Tools tools · See also: JSON Formatter, Base64 Encode / Decode.
Quick answer: Hash & HMAC Generator — SHA-1 / 256 / 512 hashes + HMAC Free, no signup, runs in your browser. See below for the interactive tool, 4-step guide and FAQs.
0 / 1,000,000 chars
Deep dives from the Tool4SaaS blog — tested workflows, print sizes and fixes.
Reviewed by the Tool4SaaS Editorial Team — In-house reviewers who build and test every tool locally for accuracy across current Chrome, Edge, Firefox, and Safari. Last updated: . See our authors, methodology or contact us.
Select SHA-1 with 40 hex characters, SHA-256 with 64, SHA-384 with 96 and SHA-512 with 128, alongside MD5 solely for legacy verification. For illustration, hello yields SHA-256 starting 2cf24dba within ten milliseconds, while 100KB manuals finish near fifty milliseconds. Uppercase toggle aligns with checksum manifests from vendors.
No. Hashing applies a one-way compression that never restores source, whereas encryption reverses with a secret key. For example, SHA-256 of mango123 appears random and discloses nothing, while AES ciphertext decrypts with Correct-Horse-9. Employ hashes for integrity fingerprints, reserve AES at /aes-encryptor for confidential messages requiring recovery.
Paste candidate and expected digest side by side; identical SHA-256 strings confirm untouched content immediately. For instance, hello must match 2cf24dba prefix, otherwise a byte shifted. Toggle uppercase for manifest alignment. All comparisons remain inside this tab. No upload occurs. Close tab afterward to clear test values completely.
Avalanche design ensures flipping one bit scrambles roughly half the output bits, exposing tampering vividly. Changing hello to hallo replaces 2cf24dba prefix with entirely foreign hex, alerting reviewers instantly. Exploit this sensitivity for download verification, version stamping, and deduplication indexes where even whitespace alterations must surface during audits.
Hashing condenses arbitrary wording into fixed-length hex fingerprints that signal integrity without revealing source. Example 1: hello produces SHA-256 starting 2cf24dba within ten milliseconds for classroom illustration. Example 2: a 100KB manual completes near fifty milliseconds, yielding 64 characters for SHA-256 versus 128 for SHA-512. Engineers checksum installers, fingerprint API payloads, and deduplicate backups efficiently. SHA-1 spans 40 characters but suffers collision flaws, MD5 spans 32 and suits only legacy checks, while SHA-384 balances length and performance. Digests compare quickly, store compactly, and expose single-byte edits through avalanche transformation across distributed pipelines. Uppercase formatting aligns with vendor manifests, lowercase suits Unix tooling, and copy buttons accelerate release verification workflows daily. Test vectors validate correctness before trusting critical deployment checksums completely.
Selection determines output breadth and collision resistance for distinct threat models. Reference digest table: MD5 is 32 hex legacy only | SHA-1 is 40 hex deprecated | SHA-256 is 64 hex standard | SHA-384 is 96 hex balanced | SHA-512 is 128 hex extensive. Paste expected value beside computed hex; matching strings confirm identical bytes, divergence flags edits. Uppercase toggle aids visual alignment with release notes. Edge case: Unicode normalization matters, so cafe precomposed versus decomposed yields divergent digests despite similar appearance. Always hash identical byte sequences, verify UTF-8 encoding, and normalize line endings before comparison across Windows and Unix contributors. Trailing newlines, BOM markers and invisible spaces frequently cause false mismatches that careful trimming resolves quickly. Document exact inputs for reproducibility.
Type hello, choose SHA-256, copy leading 2cf24dba sequence, alter one letter to hallo and witness entirely fresh hex proving avalanche. Second check: hash 100KB notes, compare against published manifest to approve downloads before installation. Limitation: unkeyed digests prove integrity, never authenticity, and rainbow tables invert common passwords, so never store mango123 hashes alone. Unlike keyed HMAC in the HMAC tab above, which binds content to a secret for webhook trust, plain hashes suit public verification. For authenticated workflows, switch to the HMAC tab above for secret-based codes. Salting and stretching through PBKDF2 or bcrypt mitigates brute force when handling credentials, while MD5 and SHA-1 remain unsuitable for security decisions. Benchmark large inputs in chunks to avoid interface stalls on modest handsets during lengthy computations daily.