Hash Generator
Generate MD5, SHA-1, SHA-256, SHA-384, SHA-512 and CRC32 digests for any text or file — plus optional HMAC-SHA-256. Everything is computed entirely in your browser with the native Web Crypto API; your input never leaves your device.
Everything is hashed locally in your browser — your input never leaves your device. No upload, no server, no logging. Safe for passwords, API keys, or confidential files.
——————HMAC combines your secret key with the message above using SHA-256 — the standard for verifying webhook signatures and API requests. Computed with Web Crypto in your browser.
Enter text or choose a file above to generate MD5, SHA-1, SHA-256, SHA-384, SHA-512 and CRC32 digests at once.
What this tool is
- A free, in-browser hash generator for text and files: MD5, SHA-1, SHA-256, SHA-384, SHA-512 and CRC32 — all computed at once as you type.
- Everything runs client-side in your browser — your input never leaves your device. Nothing is uploaded, stored or logged, so it is safe for secrets.
- SHA-256, SHA-384 and SHA-512 use the browser’s native Web Crypto API; MD5 and CRC32 use vetted pure-JavaScript implementations (Web Crypto does not support them).
- File mode hashes a whole file in-browser via FileReader — ideal for verifying a download’s checksum against the one a vendor publishes.
- SHA-256 is the modern default. MD5 and SHA-1 are cryptographically broken — fine for checksums, never for security. Hashes are not for storing passwords; use bcrypt or Argon2 for that.
What is a hash, and how does hashing work?
A hash function takes an input of any size and produces a fixed-length digest — a short fingerprint of the data. Good cryptographic hash functions have three defining properties:
- Deterministic — the same input always yields the same digest, so two parties can independently verify they have identical data.
- One-way — the digest cannot be reversed to recover the input. You can check a value against a hash, but you cannot un-hash it.
- Collision resistant — it is infeasible to find two different inputs that hash to the same digest. When this breaks (as it has for MD5 and SHA-1), the hash is no longer safe for security use.
Because a single changed bit produces a completely different digest, hashes are the backbone of integrity checking: publish the SHA-256 of a download, and anyone can re-hash the file they received and confirm it was not tampered with or corrupted in transit. The same mechanism underpins digital signatures, Git commit IDs, blockchain blocks and deduplication.
Checksums vs password hashing — don’t confuse them
A general-purpose hash like SHA-256 is built to be fast. That is perfect for a checksum, but it is exactly the wrong property for storing passwords: an attacker who steals your database can try billions of guesses per second. Hashes on this page are not meant for storing passwords. Use a deliberately slow, salted password-hashing function instead — bcrypt, scrypt or Argon2 (Argon2id is the modern recommendation). Those add a per-user salt and a tunable work factor that make large-scale guessing impractical.
Which algorithm should I use?
SHA-256 is the modern default. MD5 and SHA-1 are cryptographically broken and should only be used for non-adversarial checksums or legacy interop:
| Algorithm | Digest | Family | When to use |
|---|---|---|---|
| CRC32 | 32-bit | Checksum | Fast error-detection (zip, gzip, PNG). Not a hash — no collision resistance. |
| MD5 | 128-bit | Legacy | Broken for security. Checksums and interop with old systems only. |
| SHA-1 | 160-bit | Legacy | Broken since 2017 (SHAttered). Avoid for anything adversarial. |
| SHA-256 | 256-bit | SHA-2 | The modern default — certificates, signatures, blockchains, integrity. |
| SHA-384 | 384-bit | SHA-2 | Truncated SHA-512. Used in higher-assurance TLS suites. |
| SHA-512 | 512-bit | SHA-2 | Largest SHA-2 digest; 64-bit internals, fast on 64-bit CPUs. |
SHA-1, SHA-256, SHA-384 and SHA-512 are computed with the browser’s native Web Crypto SubtleCrypto.digest. MD5 and CRC32 (which Web Crypto does not provide) use compact, test-vector-verified pure-JavaScript implementations. No analytics or network calls are made while hashing.
Frequently asked questions
What is a hash?
A hash (or message digest) is a fixed-length fingerprint produced from any input by a hash function. Hashing has three key properties: it is deterministic (the same input always gives the same output), one-way (you cannot reverse the digest back into the original input), and — for a cryptographic hash — collision resistant (it is computationally infeasible to find two different inputs that produce the same digest). A one-character change to the input produces a completely different digest. Hashes are used for integrity checks, file checksums, digital signatures and data deduplication. SHA-256, for example, always produces a 256-bit (64 hex character) output regardless of input size.
Is MD5 secure? What about SHA-1?
No. MD5 and SHA-1 are both cryptographically broken and must not be used where security matters. Practical MD5 collisions have existed since 2004, and a full SHA-1 collision was demonstrated in 2017 (the "SHAttered" attack). An attacker can construct two different files with the same MD5 or SHA-1 digest, which defeats their use for signatures or tamper-evidence. They are still acceptable for non-adversarial uses such as checksums, cache keys or deduplication, and for interoperating with legacy systems. For anything security-sensitive, use SHA-256 or stronger from the SHA-2 family.
Does my text or file get uploaded anywhere?
No. This hash generator runs entirely in your browser. Text is hashed as you type and files are read with the browser’s FileReader and hashed in-page — no bytes are ever sent to a server, stored, or logged. That is the whole point of a client-side tool: you can safely hash a password, an API key or a confidential document without it leaving your device. You can confirm this by opening your browser’s network tab while you use the tool — there are no outbound requests.
Should I use a hash to store passwords?
No. Plain hashes like SHA-256 are designed to be fast, which is exactly the wrong property for password storage — it lets an attacker try billions of guesses per second against a stolen database. Passwords should be protected with a slow, salted password-hashing function built for the job: bcrypt, scrypt or Argon2 (Argon2id is the current recommendation). These add a per-user salt and a tunable work factor. Use SHA-256 for integrity, checksums and signatures; use Argon2/bcrypt for passwords.