Browser-only · nothing is uploaded
Hash Generator
Turn any text into a digest as you type — MD5, SHA-1, SHA-256, SHA-384 or SHA-512, shown as a lowercase hex string and as Base64 of the raw bytes. Add an optional secret key for HMAC. Every byte is hashed in this tab; nothing is sent anywhere.
Hash it
Re-hashes on every keystrokeAdvanced — HMAC secret key (optional)
How it works
Type or paste the string you want to digest. Its UTF-8 bytes (no BOM) are what gets hashed, so multibyte text matches openssl, node crypto and Python.
Choose MD5, SHA-1, SHA-256, SHA-384 or SHA-512 — or open the advanced row and add a secret key to get HMAC-<algorithm> instead (RFC 2104).
Both slots update instantly: the lowercase hex string and the Base64 of the same raw digest bytes. One click copies either one.
FAQ
Is my text sent anywhere?
No. The hashing code runs in this page and the text never leaves your device — there is no server endpoint behind this tool. You can even keep it open with the network disconnected.
Hex or Base64 — which do I need?
They are two encodings of the same digest bytes. Hex is what most docs, checksums and test vectors print (64 characters for SHA-256); Base64 is what HTTP headers, JSON payloads and PEM-ish formats often use. Give both slots the same bytes, so you can copy whichever your API expects.
Why are MD5 and SHA-1 marked legacy?
Both suffer practical collision attacks, so they must not be used for signatures, certificates or password storage. They are still handy as fast integrity checks — for example comparing two downloads — while SHA-256 remains the sensible default for everything else.
How do I reproduce this on the command line?
The digests match printf 'hello world' | openssl dgst -sha256 (or sha1/sha512), md5sum and node -e "crypto.createHash('sha256')". Base64 output equals openssl dgst -sha256 -binary | base64. For a keyed digest, HMAC values match openssl dgst -sha256 -hmac key.
Can I hash a file with this tool?
Not directly — this page hashes text you paste. Since it hashes UTF-8 bytes exactly, any string you can paste (a config blob, a JWT segment, a SQL row) produces the same value your code will.
Are the results actually correct?
Yes — every algorithm is checked at load time against published vectors (RFC 1321 for MD5, FIPS 180-4 for the SHA family, RFC 4231 for HMAC). A failing check logs to the browser console instead of silently showing a wrong digest.