OnSumoTools

Cryptographic Hash Generator

This tool generates cryptographic hashes from text or file input directly in your browser. Enter a string or upload a file, select a hash algorithm (MD5, SHA-1, SHA-256, SHA-384, SHA-512, or HMAC variants), and get the hash output instantly. No data is sent to a server. Your input text, file contents, and secret keys stay on your device. The tool is free, requires no account, and works offline after the page loads.

Input
Algorithms

Hash results

Enter text or select algorithms to see digests.

Compare hashes

How does the Hash Generator for MD5, SHA-256, SHA-512 work step by step?

The hash generator computes cryptographic digests of any text or file input using five algorithms simultaneously: MD5, SHA-1, SHA-256, SHA-384, and SHA-512. All hashing runs client-side using the browser's native SubtleCrypto API for SHA algorithms and a JavaScript fallback for MD5, so input data never leaves your device. MD5 and SHA-1 are shown for legacy compatibility and checksum verification only because both are cryptographically broken and must not be used for security-sensitive purposes like password hashing or digital signatures. SHA-256 is the current standard for checksum verification and general-purpose integrity checks; SHA-512 provides a wider digest for applications requiring higher collision resistance. For file inputs, the tool reads the file as an ArrayBuffer and hashes the raw bytes, producing the same digest as openssl dgst or shasum on the command line. Key assumption: hash functions are deterministic: identical inputs always produce identical outputs. If your computed hash does not match an expected value, the most common cause is a character encoding mismatch (UTF-8 vs UTF-16) or an invisible trailing newline in the text input. Edge case: a file with Windows line endings (CRLF) produces a different hash than the same file with Unix line endings (LF). Normalize line endings before hashing if cross-platform consistency matters.

What does a typical Hash Generator for MD5, SHA-256, SHA-512 result look like?

SHA-256 of "hello" is 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824. MD5 of "test" is 098f6bcd4621d373cade4e832627b4f6. HMAC-SHA256 with a 20-byte key of 0x0b and message "Hi There" matches the RFC 4231 test vector.

Related tools

Frequently asked questions

  • Is my input sent to a server?

    No. All hashing runs in your browser using the Web Crypto API, which is a native browser feature and not a third-party service. There is no network request. You can verify this with your browser's DevTools Network tab. This is why you can safely hash passwords, API keys, file contents, and secret messages.

  • What is the difference between MD5 and SHA-256?

    MD5 produces a 128-bit digest and is fast but cryptographically broken: collision attacks are practical, meaning two different inputs can be engineered to produce the same MD5 hash. SHA-256 produces a 256-bit digest and is currently considered secure for collision resistance. Use SHA-256 or stronger for any security-sensitive purpose. MD5 is acceptable for checksums where intentional tampering is not a concern.

  • What is an HMAC and when should I use it?

    HMAC (Hash-based Message Authentication Code) combines a hash function with a secret key. The result proves both that the message was not tampered with and that the sender knew the secret key. Use HMAC when you need to authenticate the origin of a message, such as when signing API requests, generating webhook signatures, or creating signed cookies. A plain hash without a key proves content integrity but not origin.

  • What encoding should I use for the hash output?

    Hexadecimal is the default and is the most common format for displaying hashes in documentation, logs, and checksums. Base64 uses fewer characters (SHA-256 in base64 is 44 characters vs. 64 in hex) and is the standard format for HMAC values in HTTP headers and JWTs. Most API signature schemes specify which encoding they expect.

  • Why does the same input sometimes produce different hashes on different tools?

    The most common cause is encoding. If one tool treats the input as UTF-8 and another as Latin-1, they are hashing different byte sequences. Another common cause is trailing newlines: some tools append a newline character to the input before hashing (as command-line tools like echo do by default), while others do not. This tool hashes exactly what you type with no added characters, and lets you optionally append a newline to match command-line tool behavior.

  • What is bcrypt and why is it different from SHA-256?

    bcrypt is a password hashing function, not a general-purpose hash. It is intentionally slow (the work factor is adjustable) to make brute-force attacks expensive. SHA-256 is designed to be fast, which makes it unsuitable for storing passwords: an attacker with a GPU can test billions of SHA-256 hashes per second. For password storage, always use bcrypt, Argon2, or scrypt. This tool supports bcrypt for educational and verification purposes.

What a hash does

A hash function takes any input and produces a short, fixed-size fingerprint. Change a single character and the fingerprint changes completely. The same input always gives the same result, and you can't work backward from the hash to the original.

That makes hashes handy for checking that a file wasn't corrupted, comparing two pieces of data without sharing them, and building signatures.

MD5 versus SHA-256

MD5 is old and fast. It's broken for security purposes, because attackers can create two different inputs with the same hash. It's still fine for a quick checksum where nobody is trying to fool you.

SHA-256 is part of the SHA-2 family and is the standard pick for anything that matters. Use it for file integrity and signatures. The tool covers MD5 and the SHA family, so you can compare outputs side by side.

HMAC in plain terms

An HMAC mixes a secret key into the hash. Only someone with the key can produce the matching value. APIs use it to prove a request really came from you and wasn't changed on the way. Use plain hashing to check integrity and HMAC when you also need to prove who sent the data.

Text, files and output format

Hash typed text or drop in a file. Choose hex or Base64 for the output. Hex is the usual choice for checksums. Base64 is shorter and shows up in headers and tokens. The same hash in two formats looks very different, but they represent the same bytes.

There's also a compare field. Paste the hash you were given and the tool tells you whether it matches, so you don't have to compare forty characters by eye.

Why two tools give different results

If your hash doesn't match somebody else's, the cause is almost always the input. A trailing newline, a different character encoding, or Windows line endings instead of Unix ones will change everything. Hashes are exact. Even one invisible character matters.

Not for passwords

Don't store passwords with plain SHA-256. It's too fast, which helps attackers who try billions of guesses. Use a slow, purpose-built function like bcrypt, scrypt or Argon2, which add salt and make each guess expensive.

Your input is hashed locally in the browser and isn't sent to a server.