How to Use Hash Generator: Complete Guide (2026)

What is Hash Generator?

A hash generator turns any text into a fixed-length fingerprint called a message digest, using a one-way cryptographic function. This tool computes SHA-256, SHA-1, SHA-384, and SHA-512 digests and returns the result as a lowercase hexadecimal string. HMAC mode on the same page signs a message with a secret using those same algorithms. Hashing is deterministic - the same input always produces the same output - but it is irreversible, so you cannot recover the original text from the hash. Because SHA has a strong avalanche effect, changing even a single character (or a trailing space) produces an entirely different digest, which is exactly why hashes are used to verify that data has not changed. Everything is computed in your browser with the native Web Crypto API, so the text and secret you enter are never uploaded, logged, or stored.

Generate SHA-256, SHA-1, SHA-384, and SHA-512 hashes from any text. HMAC lives on the same page. Get the lowercase hex digest instantly in your browser - nothing is uploaded.

Why use Hash Generator?

• Generate SHA-256, SHA-1, SHA-384, and SHA-512 digests from any text
• HMAC mode for a message plus secret on the same URL - no hmac-generator page
• Get the standard lowercase hex output that matches command-line and library results
• Compare a file or string against a published checksum to verify integrity
• Switch algorithms in one click to see how the digest and its length change
• Runs 100% in your browser - safe for hashing sensitive or unpublished strings

How to use Hash Generator - step by step

1. Step 1: Hash is the default tab. Choose a hash algorithm - SHA-256 is the default and the best general-purpose choice.
2. Step 2: Type or paste your text into the input box.
3. Step 3: Click "Generate hash" to compute the digest.
4. Step 4: Copy the lowercase hex output, or switch algorithms to compare digests.
5. Step 5: For HMAC, switch to HMAC mode, paste a message, enter a secret, pick an algorithm, and generate. The secret never leaves this tab.

The Hash Generator lives under Developer Tools. Open the tool page, enter your input in the main field, and results update instantly. Use the copy button to paste output into documents, code editors, or spreadsheets.

Common use cases

Verifying downloads and checksums

Software and file releases often publish a SHA-256 checksum. Hash the string or file contents and compare it character for character - if the digests match, the data is intact and untampered.

Detecting changes in data

Store the hash of a config, message, or record and re-hash it later. If the new digest differs, something changed - a fast way to spot edits or corruption without diffing the whole payload.

Generating stable identifiers and cache keys

Hash a URL, query, or content blob to produce a compact, collision-resistant key for caches, deduplication, or ETags that stays identical for identical input.

Learning HMAC and HMAC-SHA256

Switch to HMAC mode to sign a message with a secret and compare the hex digest with your code. HS256 JWTs use HMAC-SHA256; pair this page with JWT Decoder Encode when you need a signed token rather than hex.

Learning and debugging cryptography

Compare SHA-1, SHA-256, SHA-384, and SHA-512 side by side to see how digest length and output differ, and confirm your own code produces the same value for a known input like "abc".

Examples

• SHA-256 of "abc": ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad (64 hex characters, 256 bits)
• SHA-1 of "abc": a9993e364706816aba3e25717850c26c9cd0d89d (40 hex characters, 160 bits)
• Verify a download checksum: Paste a file's text or a released string and compare the SHA-256 output to the checksum the publisher provides - they must match exactly.
• HMAC-SHA256 of RFC 4231 test case 2: Message "what do ya want for nothing?" with secret "Jefe" yields 5bdcc146bf60754e6a042426089575c75a003f089d2739839dec58b964ec3843.

Pro tips

• Use SHA-256 unless you have a specific reason not to - it is the modern default for checksums and data integrity.
• Do not use a plain SHA hash for passwords; use a slow, salted algorithm like bcrypt, scrypt, or Argon2 instead.
• MD5 is not offered because the Web Crypto API does not support it and it is broken for security - prefer SHA-256.
• Whitespace is significant: a trailing newline or space changes the whole digest, so match the input exactly when comparing hashes.
• Hex output is case-insensitive in meaning but this tool always returns lowercase - normalize case before comparing digests from other tools.
• HMAC needs a secret. Never paste a production key. Pair with JWT Decoder when you want an HS256 token instead of a hex digest.

Frequently asked questions

What is a hash?

A hash (or message digest) is a fixed-length fingerprint of your input produced by a one-way function. Any change to the input - even a single character or a trailing space - produces a completely different hash. The same input always produces the same hash, which makes hashes ideal for verifying integrity and comparing data without storing the original.

Which hash algorithms does this tool support?

It supports the SHA family exposed by the browser's Web Crypto API: SHA-1 (160-bit), SHA-256 (256-bit), SHA-384 (384-bit), and SHA-512 (512-bit). SHA-256 is the recommended default for checksums and general use. HMAC mode uses the same algorithms.

Can this tool generate an MD5 hash?

No. The browser's Web Crypto API (crypto.subtle.digest) does not implement MD5, so it is not offered here. MD5 is also considered broken for security because collisions can be produced easily - prefer SHA-256 instead. If you only need MD5 for a legacy, non-security checksum, use a dedicated library on the server or command line.

Should I use a hash to store passwords?

Not a plain SHA hash on its own. Fast hashes like SHA-256 are designed for speed, which makes them a poor choice for passwords. Use a slow, salted password-hashing algorithm such as bcrypt, scrypt, or Argon2 for credentials. Plain SHA-256/512 is fine for file checksums, data integrity, and generating identifiers.

Is my text sent to a server?

No. Hash and HMAC run entirely in your browser using the standard Web Crypto API. Nothing you paste - including the HMAC secret - is uploaded, logged, or stored.

Why does adding a space or newline change the hash completely?

Hash functions have an avalanche effect: flipping even one bit of input changes roughly half the output bits. The tool hashes your input exactly as entered, including trailing spaces and newlines, so make sure the input matches precisely when you compare two digests.

Can this tool compute HMAC?

Yes. Switch to HMAC mode on this same page - there is no separate hmac-generator URL. HMAC takes a message and a secret and returns a lowercase hex digest. The secret never leaves the browser. HS256 JWTs use HMAC-SHA256; pair this with the JWT Decoder Encode tab when you need a signed token rather than a hex digest.

Related tools you might need

Explore other developer tools on ToolsMinify. Related utilities are linked on the Hash Generator page to help you complete your workflow without leaving the site.