Generate Cryptographic Hashes in Your Browser
What It Is
A cryptographic hash function takes an input (text, password, or data) and produces a fixed-size string of characters called a digest or hash. The same input always generates the same hash, but even a tiny change in the input produces a completely different hash. This tool computes MD5, SHA-1, SHA-256, SHA-512, and HMAC hashes entirely in your browser with no server uploads.
How It Works
Each algorithm breaks the input into fixed-size blocks and processes them through a series of bitwise operations, logical functions, and modular additions. MD5 uses Merkle-Damgard construction with 64 rounds. SHA-1 uses 80 rounds with a 160-bit buffer. SHA-256 and SHA-512 use 64 and 80 rounds respectively with larger state buffers. HMAC wraps any hash algorithm with a secret key, XORing the key with fixed padding constants before and after the core hash operation. All implementations here are pure TypeScript running client-side.
Worked Example
Input the text "Hello, World!" into the tool. MD5 produces "65a8e27d8879283831b664bd8b7f0ad4" (32 hex chars, 128 bits). SHA-256 produces "dffd6021bb2bd5b0af676290809ec3a53191dd81c7f70a4b28688a362182986f" (64 hex chars, 256 bits). Notice that "hello, World!" (lowercase h) produces a completely different hash, demonstrating the avalanche effect a single character change causes in the output.
Common Mistakes
Using MD5 or SHA-1 for security-sensitive contexts like password storage, digital signatures, or certificate validation is dangerous because collision attacks against both are practical. Another mistake is confusing HMAC with plain hashing: HMAC requires a secret key and provides authentication, not just integrity. Finally, forgetting that hash output encoding matters: hex encoding is the most common but base64 is more compact; mixing them up during comparison will give false negatives.
Frequently Asked Questions
Q:What is the difference between MD5, SHA-1, SHA-256, and SHA-512?
MD5 produces a 128-bit hash, SHA-1 produces 160-bit, SHA-256 produces 256-bit, and SHA-512 produces 512-bit output. SHA-256 and SHA-512 are more secure and collision-resistant, while MD5 and SHA-1 are deprecated for cryptographic signatures but still useful for checksums and non-security applications.
Q:What is HMAC and when should I use it?
HMAC (Hash-based Message Authentication Code) combines a cryptographic hash with a secret key. It provides both integrity verification and authentication. Use HMAC for API request signing, webhook verification, and any scenario where you need to verify the source of a message.
Q:Are my inputs secure when generating hashes?
Yes. All hash generation happens client-side in your browser using pure TypeScript implementations. No data is sent to servers, and no inputs leave your device. This ensures complete privacy for sensitive strings, passwords, or any content you hash.
Q:What is a collision attack and which algorithms are vulnerable?
A collision attack finds two different inputs producing the same hash. MD5 and SHA-1 are both vulnerable to collision attacks, making them unsuitable for digital signatures or certificates. SHA-256 and SHA-512 remain collision-resistant for current practical purposes.
Q:Can I hash binary data like files with this tool?
Yes. Drag and drop a file onto the file hashing area below and this tool will compute MD5, SHA-1, SHA-256, SHA-512, and HMAC hashes of the file contents using FileReader with ArrayBuffer. All processing happens client-side with no uploads to any server.