Hash Generator

Purpose

Online hash generator supporting MD5, SHA-1, SHA-256, SHA-384, SHA-512, SHA-3, SHA3-256, SHA3-512, and CRC32. Compute hash of text strings, files, or HMAC (with a secret key). Common for file integrity checking (download checksums), password digests (with salt + SHA-256), API signatures (HMAC-SHA256), and content fingerprints (deduplication). All computation runs locally; passwords or sensitive content stay in the browser.

Steps

1. Pick input mode: text / file / HMAC (with secret key)
2. Pick algorithm: MD5 (not recommended for security), SHA-256 (most common), SHA-512, SHA-3, CRC32
3. Text mode: paste or type, see hash update in real time
4. File mode: drop a file; large files use a Worker for streaming read
5. HMAC mode: enter both content and a secret key (common for API signature verification)
6. Charset: UTF-8 (default) / ASCII / GBK (affects hash result for non-ASCII text)
7. Case toggle: uppercase or lowercase hash output
8. Multi-algorithm: output MD5 / SHA-1 / SHA-256 simultaneously for comparison

FAQ

Is MD5 still usable? Why do people say it is insecure?

MD5 is fine for non-security uses: file integrity checks (detect transport corruption), content fingerprints (dedup), cache keys. Avoid MD5 for password digests, digital signatures, and tamper-evident certificates — collision attacks exist (different inputs producing the same hash). Use SHA-256 or stronger.

Why does the same string produce different hashes than someone else gets?

Usually a charset difference. "hello" pure ASCII produces identical results everywhere. CJK characters in UTF-8 vs GBK produce different byte sequences and therefore different hashes. Default is UTF-8 here; switch charset to compare. Also check line endings (CRLF vs LF).

Can a hash be reversed to recover the original?

No — hashes are one-way and theoretically irreversible. But short/weak passwords can be looked up via rainbow tables (precomputed plaintext-hash pairs). Password storage MUST use salt: hash(salt + password) with a unique salt per user. Weak MD5/SHA-1 passwords are almost all in rainbow tables.

What is HMAC? How is it different from hash + key concatenation?

HMAC is a keyed message authentication code: hash(key XOR opad || hash(key XOR ipad || message)). Defends against length-extension attacks that affect plain hash(key + message) on MD5/SHA-1/SHA-2. For API signatures always use HMAC.

How do I verify a downloaded file with its hash?

Official sites publish SHA-256 or SHA-512 checksums for downloads. Use file mode to drop the downloaded file, compare the computed hash against the official one. Match means file is intact; mismatch indicates transport corruption or middleman replacement.

Use cases

• Verifying downloads: compare SHA-256 of an installer with the published value
• API signature generation/verification: HMAC-SHA256 over request params, server-side replay protection
• Password digests: store SHA-256(salt + password), never plaintext
• Content fingerprints: compare content equivalence via hash(content), faster than byte-by-byte
• Cache key generation: compress complex query conditions to a short hash for Redis or browser cache

Use cases

Download integrity check, API HMAC signature, salted password digests, content fingerprints, cache keys. Developer, ops, security engineer. Multi-algorithm parallel output, HMAC mode, and streaming file hashing are the differentiators. Note: do not use MD5 for security scenarios.