Hash Generator
MD5, SHA-1, SHA-256, SHA-384, SHA-512 and CRC-32 of text or a local file, plus HMAC with your key — computed in the browser, checked against published vectors.
Every common digest of a text or file at once in hex and Base64, with byte counts, an optional HMAC, and a plain statement of which algorithms are safe for what.
Example: "abc" gives MD5 900150983cd24fb0d6963f7d28e17f72 and SHA-256 ba7816bf…f20015ad; "123456789" gives the CRC-32 check value cbf43926.
Digests you can verify,
with the caveats attached.
What each algorithm is for, where the values come from, why MD5 and SHA-1 are still listed, and how the file mode works without uploading anything.
Where the digests come from
SHA-1, SHA-256, SHA-384 and SHA-512 are computed by the browser's Web Cryptography API — the same implementation the platform uses for TLS. MD5 and CRC-32 are not offered by that API, so they are implemented on this page from RFC 1321 and the IEEE 802.3 polynomial and tested against the published vectors (the RFC 1321 suite, the "123456789" CRC check value cbf43926). Text is hashed as UTF-8 bytes; a file is read locally and hashed from its bytes.
Which one to use
SHA-256 is the default for integrity checks and signatures today; SHA-512 where a 64-byte digest is expected. MD5 and SHA-1 are broken for collision resistance — two different inputs can be made to share a hash — so they remain useful only for checksums against accidental corruption and for matching legacy values. CRC-32 is an error-detecting code (zip, PNG), not a hash for security. None of these is right for passwords: those need a slow, salted derivation such as Argon2, bcrypt, scrypt or PBKDF2.
HMAC
With a key, the page computes HMAC (RFC 2104) for the SHA family: a keyed digest that proves both integrity and possession of the key — the construction behind JWT HS256 and most webhook signatures. Verify against a known value with the same key encoding (this page uses the key's UTF-8 bytes; some systems expect hex or Base64 keys).
What the tool does not settle
Line endings and encoding change the bytes and therefore the hash — a file saved with CRLF hashes differently from LF. Very large files are limited by browser memory. The page does not compare against a database of known hashes. Nothing is uploaded; the same four anonymous usage counts as the rest of the site apply.
SOURCES
- RFC 1321 — The MD5 Message-Digest Algorithm
- FIPS 180-4 — Secure Hash Standard (SHA-1, SHA-2)
- RFC 2104 — HMAC: Keyed-Hashing for Message Authentication
- W3C Web Cryptography API — SubtleCrypto.digest
Last reviewed 18 September 2026. How results are checked: How we verify.