Hash Generator

This hash generator computes the MD5, SHA-1, SHA-256 and SHA-512 hashes of any text you type or paste and shows all four at once as lowercase hexadecimal, updating them while you edit. Tick Add HMAC secret key and enter a key to get keyed HMAC values in the same rows. Hashing happens in your browser, with the Web Crypto API for the SHA algorithms and a JavaScript implementation for MD5, so neither the text nor the key leaves the page.

How to use the hash generator

1. Type or paste into the Text to Hash box. The four rows fill in a moment after you stop typing, and Generate Hashes runs the same calculation on demand.
2. Leave Encoding on UTF-8. The ASCII option gives the same result, as explained under the limits below.
3. For a keyed hash, tick Add HMAC secret key and type the key into HMAC Secret Key. The rows switch to HMAC values as soon as the key box has text.
4. Press Copy next to a row to copy that digest.

Example: hashing hello world

The 11-character input hello world produces:

MD5      5eb63bbbe01eeed093cb22bb8f5acdc3
SHA-1    2aae6c35c94fcfb415dbe95f408b9ce91ee846ed
SHA-256  b94d27b9934d3e08a52e52d7da7dabfac484efe37a5380ee9088f7ace2efcde9
SHA-512  309ecc489c12d6eb4cc40f50c902f2b4d0ed77ee511a7c7a9bcd3ca86d4cd86f989dd35bc5ff499670da34255b45b0cfd830e81f605dcf7dc5542e93ae9cd76f

Python's hashlib returns the same four values, and printf 'hello world' | sha256sum prints the same SHA-256. Press Enter after the text and the SHA-256 changes to a948904f2f0f479b8f8197694b30184b0d2ed1c1cd2a1ec0fb85d299a192a447, which is what echo "hello world" | sha256sum prints, because echo appends a newline. The page hashes the box exactly as it is, spaces and line breaks included. Changing one letter has the same effect: Hello World gives the SHA-256 a591a6d40bf420404a011733cfb7b190d62c65bf0bcda32b57b277d9ad9f146e, with nothing in common with the lowercase version.

MD5, SHA-1, SHA-256 and SHA-512 compared

All four rows come from the same input, so the page works as an MD5 hash generator and a SHA256 hash generator at once, and you copy whichever digest a system asks for.

The digest length never depends on the input, so one letter and a whole page of text give hashes of the same size. None of these algorithms is meant for storing passwords, which need a slow, salted algorithm. To create the passwords themselves, use the password generator.

Checking a webhook signature

GitHub's X-Hub-Signature-256 header holds sha256= followed by an HMAC-SHA256 of the raw request body in hex. When a verification function keeps failing, paste the exact body and the shared secret here and compare. With the key whsec_test, the body {"event":"order.paid","id":1042} gives this HMAC-SHA256:

21907cbc2c6010425574a2ac4f4e52c30ffa1965fcd85bd06926cff2d4cbd5a1

Some services send the signature as Base64 instead of hex. Both are the same 32 bytes written differently, so convert one form before comparing; Base64 vs hex encoding explains how the two relate. An HS256 token is signed the same way, with HMAC-SHA256 over its header and payload, and the JWT decoder shows that signature as hex.

Other uses include creating test vectors for your own hashing code, generating a fixed-length key from a string for a cache or a lookup table, and checking whether two long values are identical by comparing their first few hex characters instead of the whole text.

Limits to know

• Only text can be hashed. The page has no file input.
• Text is always converted to UTF-8 bytes before hashing, whatever the Encoding menu is set to. Plain ASCII gives the same bytes either way, and other characters match UTF-8 tools: café has the MD5 07117fe4a1ebd544965dc19573183da2.
• In HMAC mode the SHA-1, SHA-256 and SHA-512 rows match standard HMAC libraries. The MD5 row does not follow the standard HMAC-MD5 construction, so its value will not match other tools.

For encoding rather than hashing, the developer tools listed alongside the hash generator include Base64, URL encoding and UUID tools.