Need a digest of a string for an API, a cache key, or a quick checksum? Type or paste above to get MD5, SHA-1, SHA-256, SHA-384, and SHA-512 at once, optionally as HMAC, then copy hex or Base64. To hash a download instead of text, use the file checksum tool. This hash generator is part of the programming tools on TechOpt.io.
How this hash generator chooses MD5, SHA-1, and SHA-256
A cryptographic hash maps any input to a fixed-size digest. The same text always produces the same hash; a one-bit change produces a completely different digest. That is useful for checksums and cache keys. It is not encryption: you cannot get the original text back. In the browser, SHA-2 hashes use SubtleCrypto.digest().
| Algorithm | Digest | Use today |
|---|---|---|
| MD5 | 128-bit (32 hex chars) | Legacy checksums only. Collision attacks are practical; do not use it to prove authenticity. |
| SHA-1 | 160-bit (40 hex chars) | Legacy. Broken for signatures (SHAttered). Fine only when a system still requires it. |
| SHA-256 | 256-bit (64 hex chars) | Default for new work: git, TLS, Linux sha256sum, package manifests. |
| SHA-384 / SHA-512 | 384 / 512-bit | When a protocol asks for a longer SHA-2 digest. SHA-512 is often faster than SHA-256 on 64-bit CPUs. |
Do not hash passwords with these functions alone. Use a password hash such as Argon2, scrypt, or bcrypt, which are slow on purpose. MD5 and SHA-1 are still common for file checksums and old APIs; treat them as identifiers, not security.
HMAC
HMAC (Hash-based Message Authentication Code) mixes a secret key with the message before hashing (RFC 2104). Anyone can compute SHA-256 of a string; only someone with the key can compute HMAC-SHA-256. APIs use HMAC to sign requests. Turn on HMAC above, enter the key, and the rows switch to HMAC-MD5 through HMAC-SHA-512. The key never leaves this tab.
Hex vs Base64
Hex is the usual form in docs and sha256sum output: two characters per byte, so SHA-256 is 64 hex digits. Uppercase hex is the same bits. Base64 is shorter (SHA-256 becomes 44 characters with padding) and shows up in HTTP headers, JWTs, and some APIs. The bits are identical; only the spelling changes. Paste either into Compare — colons, spaces, and a trailing filename from sha256sum are stripped.
Hash text in code
The generator above is for a quick copy. In application code, use the standard library:
echo -n 'hello' | sha256sumimport hashlib, hmac
print(hashlib.sha256(b'hello').hexdigest())
print(hmac.new(b'key', b'hello', hashlib.sha256).hexdigest())crypto.subtle.digest('SHA-256', new TextEncoder().encode('hello'));FAQ
What is the difference between MD5, SHA-1, and SHA-256?
MD5 is a 128-bit digest from 1992; collisions are cheap, so it is only for legacy checksums. SHA-1 is 160-bit and is broken for signatures. SHA-256 is the SHA-2 default: 256 bits, still the usual choice for new checksums, git, and TLS. This page also emits SHA-384 and SHA-512 when a protocol wants a longer SHA-2 digest.
What is HMAC?
HMAC combines a secret key with a hash so the digest authenticates the message, not just fingerprints it. Turn on HMAC, enter the key, and each row becomes HMAC-MD5 through HMAC-SHA-512. Use HMAC-SHA-256 (or SHA-512) for new APIs; skip HMAC-MD5 and HMAC-SHA-1 unless you must match an old system.
Hex vs Base64 — which should I copy?
Copy hex when you are matching sha256sum, git, or a docs example. Copy Base64 when an HTTP header, JWT, or API wants it. The bits are the same. Compare accepts both, plus colon-separated hex and a sha256sum line with a filename after the digest.
Can I hash a file instead of text?
Yes. Use the file checksum tool. It hashes a local file in chunks (ISOs included) and can compare the result to sha256sum or md5sum output. This page is for strings and HMAC.
Does this hash generator upload my text?
No. It runs entirely in your browser. Text, HMAC keys, and digests never leave your machine.
Is MD5 still safe to use?
Not for security. Chosen-prefix collisions are practical, so do not use MD5 to prove a file is authentic or to store passwords. It is still widely used as a non-cryptographic checksum (software mirrors, old APIs). Prefer SHA-256 unless something you must interoperate with still speaks MD5.
Why do two hashes of the same text match?
A hash is deterministic: the same algorithm and the same bytes always produce the same digest. That is the point of a checksum. If Compare says there is no match, the text, HMAC key, or algorithm differs, or the expected value is a different encoding.
Looking for more developer how-tos? Browse the programming guides or the rest of the tools.