Hash Generator
Compute cryptographic message digests and file checksums in real time using SHA-256, MD5, SHA-512, SHA-384, SHA-1, and CRC-32. Includes HMAC key authentication and hash verification with 100% client-side privacy.
How to use
Choose whether to hash raw text or calculate a checksum from an uploaded file.
Enter your string or drop any file into the browser dropzone.
Enable optional HMAC mode and provide a secret key if message authentication is required.
View instant message digests across all algorithms, copy individual hashes, or verify against an expected checksum.
Cryptographic hash algorithms overview
A cryptographic hash function takes an arbitrary block of binary data and computes a fixed-size bit string known as a digest or checksum. Hash functions are deterministic (the identical input always produces the identical digest) and one-way (infeasible to invert the digest back into the original input).
| Algorithm | Digest Length | Standard Specification | Security Status |
|---|---|---|---|
| SHA-256 | 256 bits (64 hex characters) | NIST FIPS 180-4 | Cryptographically secure. Standard for Bitcoin, TLS, and package verification. |
| SHA-512 | 512 bits (128 hex characters) | NIST FIPS 180-4 | High-security 64-bit architecture digest with massive collision resistance. |
| SHA-384 | 384 bits (96 hex characters) | NIST FIPS 180-4 | Truncated SHA-512 variant commonly utilized in TLS certificates. |
| SHA-1 | 160 bits (40 hex characters) | RFC 3174 | Deprecated for cryptographic security; still widely utilized in Git object IDs. |
| MD5 | 128 bits (32 hex characters) | RFC 1321 | Cryptographically broken (susceptible to collision attacks); used for fast non-security checksums. |
| CRC-32 | 32 bits (8 hex characters) | IEEE 802.3 | Cyclic Redundancy Check algorithm utilized for detecting accidental transmission errors in ZIP/PNG. |
HMAC (Hash-based Message Authentication Code)
HMAC (defined in RFC 2104) combines a cryptographic hash function with a shared secret key. It verifies both data integrity and data authenticity, ensuring that an API payload or webhook signature was generated by an authorized entity holding the private key.
File checksum verification
When downloading operating system ISOs, firmware binaries, or npm packages, publishers provide SHA-256 checksums to verify that downloaded files were not corrupted during transit or compromised by man-in-the-middle attacks. Our tool processes file streams entirely in your local browser through the Web Cryptography API without uploading large files over your network.
Zero server transmission guarantee
Passwords, API keys, and proprietary source code files are processed locally in your web browser. No plain text, secret keys, or files are ever sent to remote servers.
Frequently asked questions
Can a hash be converted back into the original text?
No. Cryptographic hash functions are mathematically one-way. While attackers can use rainbow tables or dictionary attacks against weak, unsalted passwords, the mathematical operation cannot be reversed.
Which hash algorithm should I use for security?
Use SHA-256 or SHA-512 for digital signatures and file integrity. For password storage, use specialized slow hashing algorithms like Argon2 or bcrypt rather than general-purpose digests.
What is HMAC and when is it required?
HMAC incorporates a secret key into the hash computation. It is commonly required for signing API requests (such as Stripe or GitHub webhooks) and verifying JSON Web Tokens (JWT).
Are my files uploaded when generating a checksum?
No. Files are read using the browser's local FileReader API and digested via the native Web Crypto API. No data is sent over the network.
Why does changing a single character completely alter the hash?
This property is called the avalanche effect. A fundamental requirement of cryptographic hash functions is that altering a single bit in the input changes approximately 50% of the output bits.