Hash Generator Guide: MD5, SHA-256, SHA-512 and HMAC

What a hash function does

A cryptographic hash function maps input of any size to a fixed-size output, called a digest. Good hash functions are one-way (you cannot recover the input from the digest), collision-resistant (you cannot find two inputs with the same digest) and sensitive to change (flipping one bit changes about half the output bits). Those properties make hashes useful for checksums, signatures, deduplication and integrity checks.

A hash is not encryption. There is no key and nothing to decrypt; the digest simply identifies the input. Short or predictable inputs, such as common passwords, can be found by hashing guesses and comparing, which is why hashing alone does not protect secrets.

A hash takes only the message; an HMAC combines the message with a secret key, so only someone with the key can produce or check the digest.

How to use the Hash Generator

Open the Hash Generator and type or paste text. Press Load example to see the classic test sentence.
The digests for every algorithm appear as hex strings.
To compute HMAC digests, tick "HMAC with a secret key" and enter the key.
Copy the digest you need, or export all of them.

The input is hashed as UTF-8. The same text in another encoding, or with a trailing newline that an editor added, produces a different digest. When comparing with a digest from a command-line tool, make sure both sides hash exactly the same bytes.

# no trailing newline: printf, not echo
printf '%s' 'The quick brown fox jumps over the lazy dog' | sha256sum
d7a8fbb307d7809469ca9abcb0082e4f8d5651e46d3cdb762d02d0bf37c9e592  -

# HMAC-SHA256
printf '%s' 'message' | openssl dgst -sha256 -hmac 'secret-key'

Algorithms and when to use them

Algorithms computed by the generator
Algorithm	Digest size	Status	Use it for
MD5	128 bits (32 hex)	Broken: collisions are practical	Non-security checksums, legacy identifiers
SHA-1	160 bits (40 hex)	Broken: collisions demonstrated	Legacy compatibility only
SHA-256	256 bits (64 hex)	Secure	Integrity checks, signatures, general use
SHA-384	384 bits (96 hex)	Secure	Where policies require larger SHA-2 digests
SHA-512	512 bits (128 hex)	Secure	General use; often fast on 64-bit systems
SHA3-224 to SHA3-512	224 to 512 bits	Secure	Where a policy names SHA-3 (FIPS 202); computed by the page, not by Web Crypto

"Broken" means an attacker can create two different inputs with the same digest. That matters whenever a hash is used to trust content, such as in certificates, code signing or document integrity. It matters much less for detecting accidental corruption of a download, where nobody is trying to craft a collision, which is why MD5 checksums are still published for some files.

Never store passwords as plain hashes

Fast hashes like SHA-256 let attackers test billions of guesses per second against a leaked database. Store passwords with a slow, salted password hashing function such as Argon2id, scrypt or bcrypt, as recommended by OWASP.

HMAC: hashes with a key

HMAC (RFC 2104) combines a hash function with a secret key. The receiver, who knows the same key, recomputes the HMAC and compares; a match proves the message was not changed and was produced by someone with the key. Webhooks, API request signing and JWTs with HS256 all rely on HMAC.

Where HMAC is used
Use	How
Webhook signatures	The sender puts `HMAC-SHA256(secret, body)` in a header; the receiver recomputes it
API request signing	Canonical request string signed with an access secret
JWT HS256	HMAC-SHA256 over the header and payload
Cookie or token integrity	Server signs a value so clients cannot change it

When verifying an HMAC in code, compare digests with a constant-time comparison function, not a normal string comparison, to avoid leaking information through timing. Use a long random key, and rotate it if it may have been exposed. The key you type into the generator stays in the page and is not sent anywhere.

Everyday uses of hashes

Where hashes show up
Use	Example	Algorithm today
File integrity	Checksum next to a download	SHA-256
Content addressing	Git objects, container image layers	SHA-1 in older Git repositories, SHA-256 for images
Caching and ETags	Fingerprint of a response body	Any fast hash; security not required
Deduplication	Detecting identical uploads	SHA-256
Subresource Integrity	`integrity="sha384-…"` on script tags	SHA-256, SHA-384 or SHA-512 (base64)
Digital signatures	TLS certificates, code signing	SHA-256 or stronger inside the signature

Subresource Integrity is a good example of a security use: the page lists the expected hash of a script loaded from a CDN, and the browser refuses to run the file if its hash differs. Note that SRI values are base64-encoded digests, while the generator shows hex; the bytes are the same, only the encoding differs.

Verifying downloads with checksums

Projects often publish SHA-256 checksums next to downloads. After downloading, compute the hash of the file locally and compare it with the published value. A match shows the file was not corrupted or swapped, provided the checksum itself came from a trustworthy page, ideally over HTTPS on the project's own site such as https://downloads.example.com.

# Linux
sha256sum example-installer.tar.gz

# macOS
shasum -a 256 example-installer.tar.gz

# Windows PowerShell
Get-FileHash .\example-installer.zip -Algorithm SHA256

The generator works on text you paste. Hash files locally with the commands above, which avoids loading large files into a browser tab and works offline.

FAQ

Is my text uploaded?

No. Hashing runs in your browser with the Web Crypto API (MD5 in JavaScript), and the input is not sent anywhere.

Can a hash be reversed?

Not mathematically. Short or common inputs can be guessed by hashing candidates, which is why hashes of passwords or simple values are not secret.

Why does my hash differ from another tool?

The bytes differ: a trailing newline, a different text encoding, or Windows line endings. Hash exactly the same bytes on both sides.

Is SHA-256 safe for passwords?

No. It is too fast. Use Argon2id, scrypt or bcrypt with a unique salt per password.

What is the difference between SHA-256 and SHA-512?

Digest size and internal word size. Both are secure SHA-2 functions; SHA-512 produces a longer digest and can be faster on 64-bit processors.

Is MD5 still useful?

For detecting accidental corruption or as a non-security identifier, yes. For anything where someone might deliberately create a collision, no.

What is a salt?

A random value stored with each password hash so identical passwords get different hashes. It defeats precomputed tables but does not make a fast hash slow.

Does the generator support SHA-3?

Yes. Turn on “Also show SHA-3” and it adds SHA3-224, SHA3-256, SHA3-384 and SHA3-512. Web Crypto has no SHA-3, so these four are computed by the page's own FIPS 202 implementation; that is slower than the native hashes, which is why they are off by default rather than always printed.

Why are there different lengths of output for the same text?

Each algorithm has a fixed digest size: 32 hex characters for MD5, 40 for SHA-1, 64 for SHA-256, 96 for SHA-384 and 128 for SHA-512. The length says nothing about the input size.

Can I hash a file with this tool?

Yes. “Hash a file” reads the file in your browser and hashes its bytes exactly as sha256sum, shasum -a 256 or Get-FileHash would locally; nothing is uploaded. A command-line tool is still faster for very large files.

How long should an HMAC key be?

At least as long as the digest, for example 32 random bytes for HMAC-SHA256. Longer keys do not hurt; short, guessable keys do.

Sources

Tools

Password Generator Generate strong random passwords in your browser with an entropy estimate.
JWT Decoder Decode JWT header and claims, warn about the algorithm and header tricks that get tokens forged, sign new tokens, and verify HS, RS, PS and ES signatures in your browser.
Encoder / Decoder Encode and decode Base64, URLs and HTML entities, and convert number bases.

Guides

Password Generator guide How the XGM Password Generator creates random passwords in your browser, what entropy bits mean, which length to choose and how to store passwords safely.
JWT Decoder guide How JSON Web Tokens are built, what the XGM JWT Decoder shows about claims and expiry, how signature verification works and which mistakes to avoid.
Encoder / Decoder guide What Base64, URL encoding and HTML entities are for, how XGM Encoder / Decoder converts UTF-8 text and number bases, and why encoding is never encryption.
UUID Generator guide How the XGM UUID Generator creates UUID v4, UUID v7 and ULID identifiers, how they differ, which to use for database keys, and how to decode a UUID.