What is Hash Generator?
Hash Generator computes cryptographic hash values for any text input using MD5, SHA-1, SHA-256, SHA-384, and SHA-512 algorithms, all processed in your browser — your data never leaves your computer. It also supports HMAC variants for all algorithms, accepting a secret key to produce a keyed-hash message authentication code.
A cryptographic hash function takes any input and produces a fixed-length output (the hash or digest) with two key properties: determinism (the same input always produces the same hash) and one-wayness (it is computationally infeasible to reconstruct the input from the hash). SHA-256 is the current standard for integrity verification; SHA-512 is used when extra collision resistance is needed.
Common uses: verifying downloaded file integrity (comparing the provided hash against a locally computed one), storing passwords securely (as salted hashes with bcrypt or Argon2 — not raw SHA-256), generating cache keys, computing Content-Security-Policy script hashes ('sha256-[base64-of-hash]'), signing API requests, and implementing webhook signature verification.
MD5 and SHA-1 are considered cryptographically broken — they have known collision attacks and should not be used for security purposes. They appear here for legacy compatibility and non-security uses like cache keys and checksums.
How to Use
- Type or paste text into the input field — hashes compute in real time.
- Select the algorithm tab: SHA-256 for security uses, MD5/SHA-1 only for legacy compatibility.
- For HMAC, click the 'HMAC' toggle and enter your secret key in the key field.
- Choose output format: hex (lowercase/uppercase) or Base64.
- Click the copy icon next to any hash to copy it to your clipboard.
Examples
SHA-256 of 'password'
Result: 5e884898da28047151d0e56f8dc6292773603d0d6aabbdd62a11ef721d1542d8 — never store this; use bcrypt or Argon2 for passwords
HMAC-SHA256 of request body for API signature
Result: Secret key: 'my-secret' + Message: '{"event":"payment"}' → e.g. 6a19f0d2... — used to verify webhook authenticity
SHA-256 for CSP script hash
Result: Hash of inline script content → script-src 'sha256-[base64hash]' — allows specific inline scripts without 'unsafe-inline'
Frequently Asked Questions
Which algorithm should I use?
For any security purpose (integrity, authentication, signatures): SHA-256 or SHA-512. For checksums and cache keys where collisions are not a security concern: MD5 or SHA-1 are fine. For password storage: do not use any hash from this tool — use bcrypt, scrypt, or Argon2 with a salt.
What is HMAC and when should I use it?
HMAC (Hash-based Message Authentication Code) combines a secret key with the message before hashing, producing a code only someone with the key can verify. Use it for API request signatures, webhook verification (e.g., Stripe, GitHub webhooks), and any case where you need to prove a message came from someone who holds the key.
Why is MD5 broken?
Researchers demonstrated in 2004 that two different inputs could produce the same MD5 hash (a collision). This means an attacker could substitute a malicious file that has the same MD5 as a legitimate one. SHA-256 has no known practical collision attacks.
What is a rainbow table attack?
Precomputed tables of hash→input pairs for common passwords. If you store SHA-256('password'), an attacker looks up the hash and instantly finds 'password'. A random salt makes each hash unique — 'password' + random salt produces a different hash each time, defeating rainbow tables.
How do CSP script hashes work?
Instead of using 'unsafe-inline', you compute the SHA-256 hash of the inline script content, Base64-encode it, and add it to your Content-Security-Policy header as script-src 'sha256-[hash]'. The browser verifies the hash before executing the script.
Related Tools