Hash Generator: MD5, SHA-256 and HMAC Step by Step
Reviewed by the OnlineFree.app team · Updated
Key points
- The Hash Generator runs entirely in your browser, so the text you hash is never uploaded anywhere.
- It outputs MD5, SHA-1, SHA-256, SHA-384 and SHA-512 digests as lowercase hex and standard Base64.
- A 32-byte SHA-256 digest is 64 hex characters or 44 Base64 characters.
- Filling the optional HMAC key row turns the same two result rows into HMAC output.
- MD5 and SHA-1 are for integrity checks and test vectors only, never for passwords or signatures.
What the Hash Generator actually does
The Hash Generator is a browser-only calculator that turns any text into a fixed-length digest using MD5, SHA-1, SHA-256, SHA-384 or SHA-512, and shows each result twice: as a lowercase hex string and as standard Base64. Nothing is sent to a server — the SHA-2 family is computed with the Web Crypto API and MD5 with a small bundled JavaScript implementation, so the text stays in the page's memory.
Input is encoded as UTF-8 without a byte-order mark before hashing, the same convention node crypto and openssl use on the command line. That matters in practice: digests produced here match those tools for plain ASCII and for multibyte text such as accented characters or emoji.
Digest sizes are fixed by the algorithm, which makes mismatches easy to spot. MD5 returns 16 bytes (32 hex characters, 24 Base64 characters), SHA-1 returns 20 bytes (40 hex, 28 Base64), SHA-256 returns 32 bytes (64 hex, 44 Base64), SHA-384 returns 48 bytes (96 hex, 64 Base64) and SHA-512 returns 64 bytes (128 hex, 88 Base64).
Hash a string in five steps
Open the Hash Generator and start typing — the text box takes focus on load, and there is no Hash button. The page re-hashes on every keystroke, so results appear as you paste. A status line underneath reports exactly what it is processing, for example "Hashing 24 bytes as SHA-256", which is your first sanity check that the paste did not bring a stray line break with it.
Step 2 is the algorithm picker, which defaults to SHA-256 because that is the safe general-purpose choice for new work. Step 3 is reading the byte count in the status line: it counts UTF-8 bytes, not characters, so an accented letter costs two bytes and a typical emoji costs four. If you expect 11 bytes and the page says 12, something invisible is in the input.
Step 4 is copying the Hex digest row with its copy button — that is the format most documentation, test vectors and command-line examples print. Step 5 is optional: expand the "Add HMAC key" row and enter a key, or read the Base64 digest row instead. Each row has its own copy button, so you never have to select monospace text by hand on a phone.
Hex or Base64: which digest do you need?
Choose hex when you are comparing against documentation, a checksum file or command-line output, and standard Base64 when an API, HTTP header or signing spec asks for it. Both rows describe the identical digest bytes; they are two encodings of one value, which is why the byte count in the status line is the same for both.
Hex uses two characters per byte and the tool emits lowercase, although many specs compare case-insensitively — some do not, so never assume casing is irrelevant. Base64 packs three bytes into four characters, which is why a 32-byte SHA-256 digest becomes 44 Base64 characters ending in a single "=" of padding.
The trap is what gets encoded. These rows are Base64 of the raw digest bytes, not Base64 of the 64-character hex text. Encoding the hex string instead produces 88 characters and will never match a server. If the spec says base64url, replace "+" with "-", replace "/" with "_", and strip the trailing "=" signs yourself.
How do you add an HMAC key?
The same page computes HMAC digests, so there is no reason to reach for a second tool. Expand the "Add HMAC key" row, pick your algorithm and type the secret key; the two result rows then relabel themselves to HMAC-MD5, HMAC-SHA-1, HMAC-SHA-256, HMAC-SHA-384 or HMAC-SHA-512 and show keyed output instead of a plain hash.
With the key field empty you get a plain digest, because an empty string is treated as no key at all. That also means an accidental space is a genuine key: HMAC-SHA-256 with a single space is a valid but completely different result. Keys are read as the UTF-8 bytes of the text you typed, so a key written as "deadbeef" is eight ASCII bytes, not the four bytes that hex pair would represent. If your API prescribes a hex or Base64 key, decode it first or expect a mismatch.
HMAC is defined in RFC 2104 and is still the standard construction for keyed request signing, from webhook verification to shared-secret API authentication. A plain hash proves nothing about who sent a message; an HMAC ties the digest to someone who holds the key.
Why MD5 and SHA-1 are legacy-only
MD5 and SHA-1 are collision-broken, meaning two different inputs can be engineered to produce the same digest. Practical MD5 collisions enabled real certificate forgery, tracked as CVE-2004-2761, and SHA-1 was deliberately collided in the 2017 SHAttered project published by Google and CWI. For anything that has to resist a motivated attacker, both are finished.
The Hash Generator says so on the label: MD5 and SHA-1 are marked "legacy / integrity only, not for security". They stay genuinely useful for matching a documented test vector, checking whether a string survived a copy-paste, or reproducing a signature that a legacy API still demands.
For new security work, use SHA-256 or above. As of 2026, FIPS 180-4 is the standard that defines the SHA-2 family the tool implements, and SHA-384 or SHA-512 are sensible choices where you want longer digests — they are not slower in any way you would notice on a short string in a browser.
Common mistakes when copying a digest
The usual cause of a mismatched digest is invisible input: a trailing newline picked up during a copy, a non-breaking space, smart quotes inserted by a word processor, or CRLF line endings where the other system used LF. The status line's byte count is the quickest diagnostic — hash the same string in both places and compare the reported length before you suspect the algorithm.
The second most common error is reading the wrong encoding. Hex and Base64 rows sit next to each other and can look similar at a glance; pasting hex into a Base64 field produces a signature failure that looks like a key problem. The third is whitespace and casing inside the digest itself — strip spaces when comparing, and keep the casing the remote spec expects.
Finally, remember what a hash is not: it is a one-way function, not encryption, so there is nothing to decrypt and no key to recover. Verify any digest you plan to ship against a second source, such as openssl sha256 on the command line or a published test vector — SHA-256 of "hello world" is b94d27b9934d3e08a52e52d7da7dabfac484efe37a5380ee9088f7ace2efcde9, and MD5 of the same string is 5eb63bbbe01eeed093cb22bb8f5acdc3.
Frequently asked questions
Is the Hash Generator on OnlineFree.app private?
Yes. The Hash Generator computes every digest inside your browser using JavaScript and the Web Crypto API, so the text you type is never uploaded to OnlineFree.app or any third party. Input lives in the page's memory and disappears when you close or reload the tab. Browser extensions, clipboard managers and shared devices can still observe what you paste, so treat those separately.
What is the SHA-256 hash of hello world?
The SHA-256 digest of the 11-byte UTF-8 string "hello world" is b94d27b9934d3e08a52e52d7da7dabfac484efe37a5380ee9088f7ace2efcde9. Type hello world into the Hash Generator with SHA-256 selected and you should see exactly that 64-character hex string. Matching a published test vector is the fastest way to confirm your input carries no trailing space or newline.
Can the Hash Generator create an HMAC-SHA256 signature?
Yes. Open the "Add HMAC key" row, choose SHA-256 as the algorithm and enter your secret as text. The result rows then show HMAC-SHA-256 in both hex and Base64 instead of a plain digest. The tool reads the key as raw UTF-8 bytes, so a key written as "deadbeef" is eight bytes, not the four bytes that hex value represents.
Should I use MD5 or SHA-1 digests from the Hash Generator for passwords?
No. MD5 and SHA-1 are collision-broken and far too fast for password storage; the Hash Generator itself labels them legacy and integrity-only. Use a dedicated memory-hard algorithm such as Argon2id, scrypt or bcrypt for passwords. For checksums, test vectors or a legacy API that explicitly specifies MD5, the tool is perfectly fine — just never treat those digests as a security control.
Why does the Base64 digest not match my API signature?
Three usual causes. First, the Hash Generator returns standard Base64 while many APIs want base64url, which swaps + for -, / for _, and drops the = padding. Second, the key may need raw bytes decoded from hex or Base64 rather than the text you typed. Third, one extra newline or space changes the digest completely, so check the byte count first.