How to use the Hash Generator
Last verified 2026-08-08 · about 6 minutes to read
The short version
- 1.Paste your text. The digest is recomputed as you type, in this browser tab.
- 2.Pick an algorithm. SHA-256 unless something specific requires otherwise. SHA-1 is provided for verifying legacy systems only.
- 3.Switch on HMAC to verify a signature. Enter the shared secret, paste the exact signed payload, and compare the result with the signature header.
Why this is worth getting right
Hashing runs through the Web Crypto API, which is the browser's native implementation rather than a JavaScript reimplementation. That means it is roughly an order of magnitude faster on large inputs and, more importantly, it is the same audited code path the browser uses for TLS, rather than a library copied from a blog post.
Method 1 — use the Hash Generator on this site
The fastest route. It runs entirely in your browser, so nothing is uploaded and there is no queue to wait in. No account is needed and there is no daily limit.
- Paste your text. The digest is recomputed as you type, in this browser tab.
- Pick an algorithm. SHA-256 unless something specific requires otherwise. SHA-1 is provided for verifying legacy systems only.
- Switch on HMAC to verify a signature. Enter the shared secret, paste the exact signed payload, and compare the result with the signature header.
Method 2 — do it without this site
Worth knowing, because a tool you cannot replace is a dependency rather than a convenience. Most tasks in the security division have a command-line or built-in equivalent; it is usually more setup and less convenient, but it works offline and it is scriptable, which matters once you are doing something a hundred times instead of once.
What this tool will not do
Every tool has an edge. These are ours for hash generator, stated up front so you find out here rather than halfway through a deadline:
- Text input only. File checksums are a separate tool.
- MD5 is not available — Web Crypto does not implement it.
- Not suitable for password storage. Use bcrypt, scrypt or Argon2.
Questions people ask
Which hash algorithm should I use?
SHA-256 for almost everything. SHA-512 is faster on 64-bit hardware and gives a longer digest, so use it if you have a reason. SHA-1 is here only to verify legacy systems — a practical collision was demonstrated in 2017 and it must not be used for anything new.
Where is MD5?
The Web Crypto API does not implement MD5, and hand-rolling it would mean shipping unaudited crypto code to every page. MD5 has been collision-broken since 2004 and has no defensible use in new work. It will be added later as a separately loaded module for checksum verification.
Can I use this to hash passwords?
No. SHA-256 is designed to be fast, which is exactly wrong for password storage — a GPU computes billions per second. Use bcrypt, scrypt or Argon2, which are deliberately slow and salted. Hashing a password with SHA-256 is a well-known and serious mistake.
What is HMAC and when do I need it?
HMAC combines a hash with a shared secret to prove a message came from someone holding that secret. Stripe, GitHub and most webhook providers sign their payloads with HMAC-SHA256, and verifying that signature is the standard way to confirm a webhook is genuine.
Is my input sent anywhere?
No. The Web Crypto API runs natively in your browser. People hash API keys, contracts and webhook payloads with these tools, so this one has no server to send anything to.
Why does my digest differ from another tool's?
Almost always a difference in the input, not the algorithm. A trailing newline, a space, or CRLF instead of LF line endings all change the digest completely — that is what a hash is for. Check the input byte for byte.