Hash Generator
MD5, SHA-1, SHA-256, SHA-512 & CRC32 with HMAC and checksum verification
Digest lengths and collision reality
A hash digests any input to a fixed-length fingerprint — one-way by design:
- MD5 (128-bit) and SHA-1 (160-bit) are broken for collisions in real attacks (SHAttered, 2017) — fine for checksums of trusted data, wrong for anything adversarial.
- SHA-256/512 remain unbroken; their length alone does not make a password safe.
- The avalanche property means flipping one bit changes roughly half the output bits — try it above.
Hashing is not encryption
Five digests at once
MD5, SHA-1, SHA-256, SHA-512, and CRC32 compute together from the same text or file, covering fingerprints, integrity checks, and checksums in a single run.
Local file hashing
Files up to 100MB are read and digested entirely on this page, making verification of a downloaded release against published checksums a purely local operation.
HMAC and verify mode
HMAC hashing with a secret key covers authenticated digests, and verify mode auto-detects which algorithm matches a pasted expected hash and highlights that row.
Frequently asked questions
Are my files uploaded to a server?
No. Text and files are hashed entirely in your browser using the Web Crypto API (SHA family) and self-contained MD5/CRC32 code. Nothing is transmitted, so it works offline and is safe for confidential data.
What is HMAC and when do I need it?
HMAC is a keyed hash used to verify both the integrity and authenticity of a message with a shared secret. Enable HMAC and enter a key to compute HMAC-MD5/SHA-1/SHA-256/SHA-512 — commonly needed for API signatures and webhooks.
Is MD5 or SHA-1 still safe to use?
For verifying downloads or non-security checksums they are fine and fast. But MD5 and SHA-1 are cryptographically broken (collisions are practical), so never use them for passwords, digital signatures or security. Use SHA-256 or SHA-512 there.
Which algorithm should store passwords?
None on this page. MD5/SHA families are built to be FAST — exactly wrong for passwords, where you want deliberate slowness. Use bcrypt, scrypt or argon2 with a per-user salt; they are key-derivation functions, not general digests.
What Is a Hash Generator?
A hash function digests any input into a fixed-size fingerprint, letting you verify integrity, compare data without exchanging it, or store a checksum instead of the content itself. This tool computes MD5, SHA-1, SHA-256, SHA-512 and CRC32 side by side from typed text or from a dropped file up to 100 MB, refreshing after a short debounce as you type. The three SHA variants run on the browser WebCrypto engine while MD5 and CRC32 ship as audited in-page code, so every algorithm resolves without network calls. An HMAC mode, an uppercase toggle and a verify lane that auto-highlights the matching algorithm complete the bench.
Five fingerprints from one input
- Text and file tabs with drag and drop, files read locally up to 100 MB with an explicit too-large refusal
- All five digests computed together, each row with its own copy button
- HMAC mode that re-keys MD5 and the SHA family with your secret; the CRC32 row rests while keyed hashing is on
- Uppercase switch that re-renders every digest without recomputing anything
- Verify box that normalizes pasted hashes and lights up the algorithm row that matches
Integrity jobs it was built for
- Checking a download against its published checksum before trusting the bytes
- Proving two files identical, or testing HMAC signing while building an API client
- Adding checksum gates to release and deployment checklists
Which fingerprint to actually trust
MD5 and SHA-1 are broken against deliberate collision attacks and must never protect passwords or signatures; they remain fine for accidental-corruption checks and legacy checksums. CRC32 is not a cryptographic hash at all, only a fast error-detection code, so equal CRC values never prove equal files. For any adversarial setting, treat SHA-256 or SHA-512 as the minimum, and remember that hashing is one-way but never secret.
Privacy: digests are computed on your device end to end; even a full-size file is hashed locally and not a single byte leaves the machine.
Last updated · 2026-09-01