Hash Generator

Generate SHA-2, SHA-1 and MD5 hashes and HMACs from text.

Input

SHA-256 Hash

A cryptographic hash function takes any input and produces a fixed-length fingerprint. The same input always produces the same hash; even a single character change produces a completely different output. This makes hashes useful for verifying data integrity, generating checksums, and storing passwords.

SHA-256, SHA-384 and SHA-512 belong to the SHA-2 family and come from the browser's built-in crypto.subtle.digest API: SHA-256 produces a 256-bit (64 hex character) digest, SHA-384 produces 384 bits, and SHA-512 produces 512 bits. Longer digests provide more collision resistance.

MD5 and SHA-1 are here for checksums and legacy systems only. Both have practical collisions: two different inputs can be made to share a digest, so neither can vouch that nobody tampered with something. They are still what many download pages, git object ids and older APIs use, which is the reason to offer them. SHA-1 comes from the same browser API; browsers have never offered MD5, so it is computed by this page's own code, a 128-bit (32 hex character) digest checked against the test vectors in RFC 1321.

HMAC mode computes a keyed hash with any of the five, as defined in RFC 2104 — with crypto.subtle.sign, except HMAC-MD5, which the browser refuses and this page computes itself. It is what signs webhook payloads and API requests: both sides hold the same secret key, and only someone with it can produce the matching MAC. The key is read either as the UTF-8 bytes of the text you type or as hex, two digits per byte. It never leaves this page: the link format below has no place for it, and nothing you type here is written to the address bar.

For key derivation, or hashing the output of another step, use CyberChef. It chains operations into a recipe, runs locally in your browser, and is free and open source with no account, though its page runs Google Analytics. For checksumming a large file off disk, stay here — File Checksum streams it rather than loading it into a recipe.

Link to this tool with values filled in

Everything after the # stays in your browser — it is never sent to a server — so a link like this opens the tool ready to go without the values travelling anywhere but the address bar:

https://crunchify.net/tools/hash#text=hello&algorithm=SHA-256

Join the settings with &, and percent-encode each value so that spaces, newlines and any #, &, = or % inside one do not break the link. Leave a setting out to accept its default. If a setting is not recognised, the page says so rather than quietly ignoring it.

text (also input, value, q or string) — text, up to 1024 characters, required. The text to hash.
algorithm (also algo or hash) — SHA-256, SHA-384, SHA-512, SHA-1 or MD5, defaults to SHA-256. SHA-1 and MD5 are broken: offer them only to match a published checksum or a legacy system.
format (also encoding or output) — hex, base64 or base64url, defaults to hex. How to render the digest bytes.

The tool reads these on arrival but never writes them back, so what you type here stays out of your browser history.

What is a hash and what is it used for?

A cryptographic hash function produces a fixed-length fingerprint (digest) from any input. The same input always gives the same hash; any change in input gives a completely different hash. Uses: verifying file integrity, storing passwords safely, generating checksums, and digital signatures.

What is the difference between SHA-256, SHA-384, and SHA-512?

All three are in the SHA-2 family. SHA-256 produces a 256-bit (64 hex character) digest; SHA-384 produces 384 bits; SHA-512 produces 512 bits. Longer digests provide more collision resistance. SHA-256 is the most widely used; SHA-512 can be faster on 64-bit CPUs.

Is it safe to use MD5 or SHA-1?

Not for security. Both have known collision attacks: it is computationally feasible to craft two different inputs that produce the same hash, so neither can prove a file or message was not tampered with. They are offered for matching a checksum someone else published, and for legacy systems that still require them. Use SHA-256 for anything new.

Can I use a hash to store passwords?

Not raw SHA hashes — they are too fast, making brute-force attacks practical. For password storage, use a dedicated password hashing algorithm: bcrypt, scrypt, or Argon2. These are deliberately slow and include a salt to prevent rainbow table attacks.

How do I check a webhook signature with HMAC?

Switch to HMAC mode, pick the algorithm the sender documents (usually SHA-256), paste the shared signing secret as the key and the raw request body as the message. Compare the result with the signature header in the same encoding — most providers send hex, some base64. The body must be byte-for-byte what was sent: re-formatted JSON produces a different MAC.

How do I verify a file download using a hash?

The file provider publishes the expected hash (e.g., SHA-256: abc123...). After downloading, compute the hash of your file and compare. If they match, the file is intact and unmodified. Any difference means the file was corrupted or tampered with.

Updated October 17, 2026