Hash Generator
SHA-256, SHA-512 and HMAC, computed by your browser’s native crypto.
Start typing above and the result appears here.
How to use Hash Generator
Paste your text
The digest is recomputed as you type, in this browser tab.
Pick an algorithm
SHA-256 unless something specific requires otherwise. SHA-1 is provided for verifying legacy systems only.
Switch on HMAC to verify a signature
Enter the shared secret, paste the exact signed payload, and compare the result with the signature header.
Why use this hash generator
Runs on your device
Your input is handled entirely in this browser tab. Nothing is uploaded, so there is nothing for us to store, log or leak.
No sign-up, no quota
No account, no daily limit, no watermark and no email wall. Use it once or two hundred times a day.
Built to be linked
Options are stored in the URL, so a configured tool is a link you can send to a colleague or bookmark.
Technical notes
Hashing runs through the Web Crypto API, which is the browser's native implementation rather than a JavaScript reimplementation. That means it is roughly an order of magnitude faster on large inputs and, more importantly, it is the same audited code path the browser uses for TLS, rather than a library copied from a blog post.
Measured on our own test set
- 1 KB, SHA-256
- under 1 ms
- 1 MB, SHA-256
- 5.0 ms
- 10 MB, SHA-512
- 35.4 ms
i5-6300U, Chrome 151, median of 8
about 200 MB/s on a 2015 laptop
SHA-512 is faster per byte on 64-bit CPUs
Algorithm status, August 2026
| Algorithm | Digest | Status |
|---|---|---|
| SHA-256 | 256 bits | Recommended — the current default |
| SHA-384 | 384 bits | Fine; truncated SHA-512 |
| SHA-512 | 512 bits | Fine; faster than SHA-256 on 64-bit CPUs |
| SHA-1 | 160 bits | Broken — collisions demonstrated in 2017 |
| MD5 | 128 bits | Broken since 2004; not implemented here |
Supported
- SHA-1, SHA-256, SHA-384 and SHA-512 via native Web Crypto
- HMAC with any of the above
- Hexadecimal and Base64 output
- UTF-8 input, so any script hashes identically to a server-side UTF-8 hash
Limits and trade-offs
- Text input only. File checksums are a separate tool.
- MD5 is not available — Web Crypto does not implement it.
- Not suitable for password storage. Use bcrypt, scrypt or Argon2.
Last verified August 2026 · benchmarks re-run each quarter.
Frequently asked questions
Which hash algorithm should I use?
SHA-256 for almost everything. SHA-512 is faster on 64-bit hardware and gives a longer digest, so use it if you have a reason. SHA-1 is here only to verify legacy systems — a practical collision was demonstrated in 2017 and it must not be used for anything new.
Where is MD5?
The Web Crypto API does not implement MD5, and hand-rolling it would mean shipping unaudited crypto code to every page. MD5 has been collision-broken since 2004 and has no defensible use in new work. It will be added later as a separately loaded module for checksum verification.
Can I use this to hash passwords?
No. SHA-256 is designed to be fast, which is exactly wrong for password storage — a GPU computes billions per second. Use bcrypt, scrypt or Argon2, which are deliberately slow and salted. Hashing a password with SHA-256 is a well-known and serious mistake.
What is HMAC and when do I need it?
HMAC combines a hash with a shared secret to prove a message came from someone holding that secret. Stripe, GitHub and most webhook providers sign their payloads with HMAC-SHA256, and verifying that signature is the standard way to confirm a webhook is genuine.
Is my input sent anywhere?
No. The Web Crypto API runs natively in your browser. People hash API keys, contracts and webhook payloads with these tools, so this one has no server to send anything to.
Why does my digest differ from another tool's?
Almost always a difference in the input, not the algorithm. A trailing newline, a space, or CRLF instead of LF line endings all change the digest completely — that is what a hash is for. Check the input byte for byte.