A hash (or message digest) is a fixed-length fingerprint of your input produced by a one-way function. Any change to the input - even a single character or a trailing space - produces a completely different hash. The same input always produces the same hash, which makes hashes ideal for verifying integrity and comparing data without storing the original.

Which hash algorithms does this tool support?

It supports the SHA family exposed by the browser's Web Crypto API: SHA-1 (160-bit), SHA-256 (256-bit), SHA-384 (384-bit), and SHA-512 (512-bit). SHA-256 is the recommended default for checksums and general use. HMAC mode uses the same algorithms.

Can this tool generate an MD5 hash?

No. The browser's Web Crypto API (crypto.subtle.digest) does not implement MD5, so it is not offered here. MD5 is also considered broken for security because collisions can be produced easily - prefer SHA-256 instead. If you only need MD5 for a legacy, non-security checksum, use a dedicated library on the server or command line.

Should I use a hash to store passwords?

Not a plain SHA hash on its own. Fast hashes like SHA-256 are designed for speed, which makes them a poor choice for passwords. Use a slow, salted password-hashing algorithm such as bcrypt, scrypt, or Argon2 for credentials. Plain SHA-256/512 is fine for file checksums, data integrity, and generating identifiers.

Is my text sent to a server?

No. Hash and HMAC run entirely in your browser using the standard Web Crypto API. Nothing you paste - including the HMAC secret - is uploaded, logged, or stored.

Why does adding a space or newline change the hash completely?

Hash functions have an avalanche effect: flipping even one bit of input changes roughly half the output bits. The tool hashes your input exactly as entered, including trailing spaces and newlines, so make sure the input matches precisely when you compare two digests.

Can this tool compute HMAC?

Yes. Switch to HMAC mode on this same page - there is no separate hmac-generator URL. HMAC takes a message and a secret and returns a lowercase hex digest. The secret never leaves the browser. HS256 JWTs use HMAC-SHA256; pair this with the JWT Decoder Encode tab when you need a signed token rather than a hex digest.

Developer Tools

Hash Generator

Use this free hash generator to create a cryptographic hash (message digest) from any text using SHA-256, SHA-1, SHA-384, or SHA-512.

Mode

Hash algorithm

Text to hash

SHA-256 hash (hex)

About Hash Generator

Use this free hash generator to create a cryptographic hash (message digest) from any text using SHA-256, SHA-1, SHA-384, or SHA-512. Paste your input, pick an algorithm, and get the lowercase hexadecimal digest instantly. Hashing is one-way: the same input always produces the same fixed-length output, but you cannot reverse a hash back to the original data. HMAC mode on this same page signs a message with a secret (HMAC-SHA256 and the other SHA algorithms the browser supports). Everything runs client-side with the browser's built-in Web Crypto API, so your text and secret are never uploaded, logged, or stored.

How to Use Hash Generator

Hash is the default tab. Choose a hash algorithm - SHA-256 is the default and the best general-purpose choice.
Type or paste your text into the input box.
Click "Generate hash" to compute the digest.
Copy the lowercase hex output, or switch algorithms to compare digests.
For HMAC, switch to HMAC mode, paste a message, enter a secret, pick an algorithm, and generate. The secret never leaves this tab.

Hash Generator Examples

SHA-256 of "abc"

ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad (64 hex characters, 256 bits)

SHA-1 of "abc"

a9993e364706816aba3e25717850c26c9cd0d89d (40 hex characters, 160 bits)

Verify a download checksum

Paste a file's text or a released string and compare the SHA-256 output to the checksum the publisher provides - they must match exactly.

HMAC-SHA256 of RFC 4231 test case 2

Message "what do ya want for nothing?" with secret "Jefe" yields 5bdcc146bf60754e6a042426089575c75a003f089d2739839dec58b964ec3843.

SHA-256 vs MD5

Read the full guide

How to Use Hash Generator: Complete Guide (2026) - 5 min read

Frequently Asked Questions about Hash Generator

What is a hash?: A hash (or message digest) is a fixed-length fingerprint of your input produced by a one-way function. Any change to the input - even a single character or a trailing space - produces a completely different hash. The same input always produces the same hash, which makes hashes ideal for verifying integrity and comparing data without storing the original.
Which hash algorithms does this tool support?: It supports the SHA family exposed by the browser's Web Crypto API: SHA-1 (160-bit), SHA-256 (256-bit), SHA-384 (384-bit), and SHA-512 (512-bit). SHA-256 is the recommended default for checksums and general use. HMAC mode uses the same algorithms.
Can this tool generate an MD5 hash?: No. The browser's Web Crypto API (crypto.subtle.digest) does not implement MD5, so it is not offered here. MD5 is also considered broken for security because collisions can be produced easily - prefer SHA-256 instead. If you only need MD5 for a legacy, non-security checksum, use a dedicated library on the server or command line.
Should I use a hash to store passwords?: Not a plain SHA hash on its own. Fast hashes like SHA-256 are designed for speed, which makes them a poor choice for passwords. Use a slow, salted password-hashing algorithm such as bcrypt, scrypt, or Argon2 for credentials. Plain SHA-256/512 is fine for file checksums, data integrity, and generating identifiers.
Is my text sent to a server?: No. Hash and HMAC run entirely in your browser using the standard Web Crypto API. Nothing you paste - including the HMAC secret - is uploaded, logged, or stored.
Why does adding a space or newline change the hash completely?: Hash functions have an avalanche effect: flipping even one bit of input changes roughly half the output bits. The tool hashes your input exactly as entered, including trailing spaces and newlines, so make sure the input matches precisely when you compare two digests.
Can this tool compute HMAC?: Yes. Switch to HMAC mode on this same page - there is no separate hmac-generator URL. HMAC takes a message and a secret and returns a lowercase hex digest. The secret never leaves the browser. HS256 JWTs use HMAC-SHA256; pair this with the JWT Decoder Encode tab when you need a signed token rather than a hex digest.

Bcrypt Hash Generator

Free bcrypt hash generator and verifier in your browser. Hash passwords with configurable rounds, then verify hashes locally - nothing is uploaded.

JWT Decoder

Decode JWT header, payload, and signature in your browser. Encode HS256 test tokens on the same page. Free JSON Web Token decoder - nothing uploaded.

UUID Generator

Generate UUID v4, UUID v7, ULID, or NanoID in your browser. Create one or many IDs for databases, APIs, and testing - nothing is uploaded.

Base64 Encoder / Decoder

Free online Base64 encoder and decoder. Encode text to Base64 or decode Base64 back to plain text, with full Unicode (UTF-8) support - runs entirely in your browser.

URL Encoder / Decoder

Encode or decode percent-encoded URLs, or build and parse query strings from key/value pairs. encodeURIComponent, encodeURI, and parse-back - all in your browser.