Hash text with MD5, SHA-1, SHA-256, SHA-384 and SHA-512 at once, or compute an HMAC with a key -- all in your browser. Fast, free, and built for simple browser-based workflows.
Hashing happens in this browser tab using the Web Crypto API and hand-written MD5. Nothing you type is sent anywhere.
Hashes
Type or paste text above — hashes update as you type.
MD5 and SHA-1 are broken for security use (collisions are practical to create). They are fine for checksums and cache keys, never for storing passwords — a password hashing function like bcrypt exists for that.
Different result from echo "text" | sha256sum? echo adds a trailing newline your terminal does not show. Use printf '%s' "text" or echo -n to match what this page hashes.
728 x 90 In-Content Ad
Hash Generator is a free online tool that computes MD5, SHA-1, SHA-256, SHA-384, and SHA-512 hashes of any text at once, right in your browser. Switch to HMAC mode to compute the same five algorithms keyed with a secret instead, so you can verify a message came from someone who holds that key.
It earns its keep whenever you need to verify or compare data: checking that a downloaded file's checksum listed elsewhere matches what you have, confirming two copies of a document are byte-for-byte identical, generating a cache key or deduplication fingerprint for a build pipeline, or computing an HMAC signature to test against an API's webhook verification code. The hex, uppercase, and Base64 output formats mean the result pastes straight into whichever format your code or config expects.
Hashing happens entirely in your browser: SHA-1 through SHA-512 use the Web Crypto API, and MD5 -- which browsers do not implement natively -- is computed by a hand-written implementation, so nothing you type is ever sent to a server. That matters for HMAC especially, where the key is effectively a secret; it stays local the whole time, and Clear wipes it completely.
Type or paste into the Text to hash box. Hashes for all five algorithms update as you type.
Switch Input is to Hex bytes or Base64 bytes if you are hashing encoded data instead of plain text.
Open More options, tick Compute HMAC with a key instead, and type your key to switch every row to its HMAC value.
Click Copy next to any algorithm's row to copy just that value, or Generate Hashes to force a refresh on very large input.
Yes! All our tools are 100% free to use with no hidden costs, no registration required, and no credit card needed.
Absolutely. All tools run entirely in your browser (client-side). Your data never leaves your device and is not sent to our servers.
Yes, once the page is loaded, the tool will continue to work even if you lose internet connection since it runs in your browser.
There is no strict character limit, but very large amounts of text (100,000+ characters) may slow down your browser.
Yes! All our tools are free for both personal and commercial use.
You can, but you should not use the result to store a password. MD5 and SHA-256 are fast general-purpose hashes, designed to be computed millions of times a second -- exactly the property that makes them easy to crack by brute force. Password storage needs a deliberately slow function such as bcrypt or Argon2 instead.
Because a salt only matters for password hashing, which this tool is not for (see the previous question). A generic hash of text plus a fixed salt string is no safer against brute force -- it just changes the input. Real password hashing functions generate and store a random salt automatically as part of the algorithm.
echo adds a trailing newline character that your terminal does not show, so it hashes one extra byte you did not type. Use printf '%s' "text" or echo -n "text" instead, and the result will match exactly what this page hashes.
A hash takes only your text and always gives the same result for the same input, so anyone can recompute and check it. An HMAC also takes a secret key, so only someone who knows the key can produce or verify the correct value -- useful for confirming a message came from someone who holds that key, not just that the text was not altered.
Not on this page -- it hashes whatever text you type or paste, up to whatever your browser can hold comfortably in a text box. Checksumming a file needs a tool that reads the file's actual bytes directly, rather than text pasted into a box.
Safe for checksums and cache keys, where you just need to detect accidental changes -- not safe anywhere security matters. Both have practical collision attacks (two different inputs producing the same hash), so neither should verify a security-sensitive signature or protect a password. SHA-256 and above have no such known weakness.
Every hash function is defined for the empty string too, and it is not a special case -- MD5 of nothing is always d41d8cd98f00b204e9800998ecf8427e, for example. Showing it rather than an error confirms the tool is actually working, and it is a common way to sanity-check a hash implementation.
Yes. Switch Input is to Hex bytes or Base64 bytes, and your input is decoded to raw bytes before hashing instead of being treated as UTF-8 text. This matters when you need to hash a binary value -- an encryption key or an existing hash's raw bytes -- rather than its text representation.
No. The key is used only to compute the HMAC locally and is never written to storage, included in a URL, or sent anywhere -- not even in an error report if something goes wrong. Clicking Clear also wipes the key field, so nothing lingers after you are done.
This page computes a one-off HMAC, but does not check it against a received signature. For checking a webhook from GitHub, Stripe or Shopify -- with the signature format detected automatically -- use the dedicated HMAC Generator tool instead.