Hash & HMAC Generator
Generate SHA-1/256/384/512 and MD5 hashes plus keyed HMAC codes.
Tool code processes selected files and entered content in your browser and does not submit them to a TOOLGRID processing endpoint. TOOLGRID measures tool usage, not the content you enter.
Loading tool…
Browser-basedWhat this tool does
Hash and HMAC generator using the browser's Web Crypto API. Switch between plain hash mode and keyed HMAC mode for webhook signatures and API signing.
Picks the right tool for your verification need: a plain hash answers "is this content unchanged?" An HMAC answers "is this content unchanged AND did the signer have the shared secret?" Many security bugs come from using a plain SHA-256 where an HMAC was required (a plain hash can be regenerated by anyone with the content).
Hashing uses the browser's native Web Crypto API where available (SHA family) and a pure-JS implementation for MD5. Tool code does not submit entered text or secret keys to a TOOLGRID processing endpoint. Browser-local processing is not a blanket security guarantee; review browser extensions, device security, and shared sessions before handling sensitive material.
What you can do with this tool
Paste the exact text payload and compare its digest with a known test vector or integration fixture.
Recreate an HMAC from a captured non-sensitive test payload and development secret, then compare the hex result with the sender's signature.
Hash a pasted normalized manifest, query, or text payload to create a cache key that changes when that exact text changes.
What to check before relying on the result
- Performance and maximum practical input size depend on browser memory, device speed, and the structure of the input.
- Review the generated result before replacing or publishing an original file.
How to use
- 1
Pick a mode — Hash for plain digests, HMAC for keyed codes.
- 2
In HMAC mode, pick an algorithm (HMAC-SHA1/256/512) and paste your secret key.
- 3
Type or paste your input. The hash output updates live; copy the variant you need.
Use Cases
Paste the exact text payload and compare its digest with a known test vector or integration fixture.
Recreate an HMAC from a captured non-sensitive test payload and development secret, then compare the hex result with the sender's signature.
Hash a pasted normalized manifest, query, or text payload to create a cache key that changes when that exact text changes.
Hash normalized text fixtures to detect whether a message or generated configuration changed between test runs.
Tips & Tricks
MD5 and SHA-1 are cryptographically broken for security purposes. Use SHA-256 or SHA-512 for anything security-sensitive.
The same input always produces the same hash. Even a single character difference produces a completely different hash.
You cannot reverse a hash to recover the original input. This makes hashing suitable for verification, but not encryption.
FAQ
Is my input sent to a server for hashing?
Hashing uses the browser's built-in Web Crypto API. Tool code processes selected files and entered content in your browser and does not submit them to a TOOLGRID processing endpoint. Browser-local processing avoids a TOOLGRID upload path, but it is not a blanket security guarantee.
What hash algorithms are supported?
MD5, SHA-1, SHA-256, and SHA-512 are supported for plain text digests. HMAC mode supports SHA-1, SHA-256, and SHA-512. SHA-256 is the usual default for modern interoperability.
Is MD5 safe to use?
MD5 is not safe for security purposes — collisions can be generated intentionally. It remains useful only when an existing non-security text fixture or legacy integration explicitly requires MD5.
Can I hash a file instead of text?
Not in this tool — the input is text-only. For hashing files locally, use a command-line tool: shasum -a 256 file (macOS/Linux), CertUtil -hashfile file SHA256 (Windows), or Get-FileHash file -Algorithm SHA256 (PowerShell). Browsers can hash file Blobs via Web Crypto too, but exposing that here would require a different workflow than the current paste-and-hash UI.
What's the difference between hash and HMAC?
A plain hash (SHA-256, MD5, etc.) only depends on the input — anyone can compute it given the content. An HMAC adds a secret key: the same input with a different key produces a different output. Use HMAC when you need to prove a message came from someone with the shared secret (webhook signatures, API request signing, session integrity). Use a plain hash for content fingerprinting and deduplication.
What's the difference between a hash and encryption?
Encryption is reversible given the right key — you can recover the original content. Hashing is one-way — given a hash, you can't recover the input (you can only check whether a candidate input produces the same hash). Use encryption for confidentiality; use hashing for integrity verification and content fingerprinting.
Useful next steps
Open a nearby browser tool when you need to validate, convert, or reuse the result.