Hash Generator Online Free
Generate MD5, SHA-1, SHA-256, SHA-384, SHA-512, and SHA-3 hashes from any text or file. Instant output, compare mode, batch hashing, and HMAC support. All processing stays in your browser.
Enter one value per line. Each line will be hashed with all selected algorithms.
How this hash generator combines native crypto with hand-written algorithms
Modern browsers ship a real cryptographic library, the Web Crypto API, but it deliberately leaves out MD5 and SHA-3 because both are considered weak or nonstandard for security work. This tool covers that gap by implementing MD5 and Keccak-based SHA-3 (256 and 512-bit) entirely in hand written JavaScript, alongside SHA-1, SHA-256, SHA-384, and SHA-512, which come straight from the browser’s native crypto.subtle.digest. Seven algorithms, two different code paths, one consistent interface.
All hashing happens locally: native algorithms run through window.crypto.subtle, and MD5/SHA-3 run through pure JavaScript bit operations in this file. No text, file, or hash ever leaves your browser; there is no network call anywhere in the script.
Two hashing engines, one output format
| Algorithm | Output length | Engine |
|---|---|---|
| MD5 | 128 bits (32 hex chars) | Hand-written JS, 64-round Merkle-Damgard construction |
| SHA-1 | 160 bits (40 hex chars) | Web Crypto API |
| SHA-256 | 256 bits (64 hex chars) | Web Crypto API |
| SHA-384 | 384 bits (96 hex chars) | Web Crypto API |
| SHA-512 | 512 bits (128 hex chars) | Web Crypto API |
| SHA3-256 / SHA3-512 | 256 / 512 bits | Hand-written JS Keccak-f[1600] permutation |
What the MD5 implementation actually does
Since crypto.subtle won’t compute MD5, the tool carries its own implementation of the full algorithm: UTF-8 byte conversion, padding the message to a length congruent to 56 mod 64, appending the original bit length as a 64-bit value, then running four rounds of 16 operations each (the classic FF, GG, HH, and II bitwise functions) across four 32-bit state words.
0x80 byte is appended, then zero bytes fill the buffer until its length is 56 modulo 64, leaving exactly 8 bytes free for the length field.
ArrayBuffer data directly and don’t have that limitation.HMAC mode
When a secret key is supplied, SHA-1 through SHA-512 switch to HMAC via crypto.subtle.importKey and sign, producing a keyed hash for verifying message authenticity rather than a plain digest. MD5 and SHA-3 are excluded from HMAC mode since Web Crypto doesn’t support them as HMAC hash functions.
Compare mode
Runs one chosen algorithm against two separate text inputs and reports a direct match or mismatch, useful for confirming two pieces of text are byte-for-byte identical without eyeballing two long hex strings.
Batch mode
Hashes every non-empty line of a multi-line input independently, producing one output line per input line with all active algorithms’ results appended, for processing lists of values at once.
Cryptographic standards
- RFC 1321 is the original MD5 specification this tool’s hand-written implementation follows.
- FIPS 180-4 is the NIST standard defining SHA-1 through SHA-512, all computed here via Web Crypto.
- FIPS 202 defines SHA-3 and the underlying Keccak sponge construction implemented by hand in this tool.
- MDN: SubtleCrypto.digest() documents the native browser API this tool wraps for its non-MD5, non-SHA-3 algorithms.
- RFC 2104 specifies HMAC, the keyed-hashing construction used in HMAC mode.
Where hashing gets used
Verifying a downloaded file’s SHA-256 checksum against the value published by its distributor, generating a quick MD5 fingerprint for legacy systems that still expect it, checking whether two configuration files or text blobs are truly identical using compare mode, computing HMAC signatures for testing webhook payload verification, and batch hashing a list of values, such as passwords for a training exercise, in one pass.
FAQ: Hash Generator Online Free
A hash generator takes any input (text, file, or data) and produces a fixed-length string called a hash or digest. Hashes are used to verify file integrity, store passwords securely, sign API requests, generate checksums, and confirm that data has not been tampered with.
MD5 and SHA-1 are older algorithms that produce shorter hashes and are considered cryptographically broken. They are still useful for checksums and non-security purposes. SHA-256 is the most widely used secure algorithm today. SHA-512 offers a longer output with higher security margin. For new systems, SHA-256 or SHA-512 is recommended.
No. All hashing runs inside your browser using the Web Crypto API and pure-JavaScript implementations. Nothing leaves your device. You can safely hash passwords, API keys, and confidential documents.
HMAC (Hash-based Message Authentication Code) combines a hash function with a secret key. It confirms both that the data has not changed and that the sender holds the correct key. HMAC is commonly used in webhook signatures, API request authentication, and JWT tokens.
Yes. Switch to File Hash mode and drop any file onto the upload area. The tool reads the file in your browser and computes SHA-1, SHA-256, SHA-384, and SHA-512 hashes immediately. This is useful for verifying that a downloaded file matches the checksum published by its source.
Batch mode lets you enter one value per line and hash all of them at once using every selected algorithm. The output shows each input alongside its hashes in a structured format you can copy or download as a .txt file.
No. Hash functions are one-way by design. There is no mathematical way to reverse a hash back to its input. Attackers can try to crack weak passwords by hashing common words and comparing results, which is why salted hashing is used for password storage.
From the blog
Deep dives on the things these tools touch
Minification, UUID collisions, diffing API responses, and the other questions that come up around this toolset.
