Hash Generator
Generate a cryptographic hash from any text or file. All five algorithms at once, plus HMAC signing and a verify mode. Runs entirely in your browser, no upload, no sign-up, no watermark.
- MD5, SHA-1, SHA-256, SHA-384, SHA-512
- Hash text and files without uploading
- HMAC signing with a secret key
- Verify mode matches an existing hash
Result
Type or paste text above and the hashes will appear here.
Paste a hash you were given and the tool highlights which algorithm (if any) produces it.
Everything runs in your browser. Nothing is uploaded. Nothing is logged.
- 100% Free
- No Sign-Up
- No Upload
- 5 Algorithms
- HMAC Support
- Works Offline
The five algorithms compared
Each algorithm produces a different length of output. Only one of them is a safe choice for new cryptographic work.
| Algorithm | Bits | Hex chars | Status | Common use |
|---|---|---|---|---|
| MD5 | 128 | 32 | Broken for security | Non-security checksums, legacy systems, deduplication |
| SHA-1 | 160 | 40 | Deprecated for security | Git internals, legacy signatures, checksums where collision is not a risk |
| SHA-256 | 256 | 64 | Recommended | File integrity, TLS certificates, blockchains, HMAC, password verifiers |
| SHA-384 | 384 | 96 | Recommended | Higher security margin for signatures and long-lived data |
| SHA-512 | 512 | 128 | Recommended | Maximum security margin, high-assurance signatures, sensitive data |
Which hash should you use?
Six common goals and the algorithm that fits each one.
| Goal | Recommended | Why |
|---|---|---|
| Verify a file download | SHA-256 | Published by nearly every release page, fast to compute, no known collisions |
| Sign a webhook payload | HMAC-SHA-256 | The de facto standard for Stripe, GitHub, Slack and most providers |
| Detect duplicate files | SHA-256 or MD5 | Both are fine for accidental duplicates. MD5 is faster and enough when there is no adversary |
| Reproduce a legacy system | Whatever it uses | The tool shows all five at once so you can match an old MD5 or SHA-1 value directly |
| Long-lived cryptographic signature | SHA-384 or SHA-512 | Larger output gives more margin against future cryptanalysis |
| Quick content fingerprint | MD5 | Short output, fast, and fine when security is not the point |
Why this is the best free hash generator
Most hash tools make you pick one algorithm at a time and force the input through a server. This one gives you all five, in your browser.
| Feature | TToolDeck | Typical online hash tool | Desktop command line |
|---|---|---|---|
| Runs entirely in your browser | Yes | Partial | Yes |
| No sign-up or email | Yes | Partial | Partial |
| MD5 + SHA family in one page | Yes | Yes | Partial |
| Hash from text and files | Yes | Partial | Yes |
| HMAC signing built in | Yes | No | Partial |
| Verify mode highlights matches | Yes | No | No |
| Uppercase and lowercase output toggle | Yes | Partial | Yes |
| Copy all five hashes at once | Yes | No | Partial |
| No account, no quota, no rate limit | Yes | Partial | Yes |
| Works offline after first load | Yes | No | Yes |
Comparison reflects publicly available information at the time of writing. Features may change. Representative examples of common patterns.
More free developer tools
Free browser-based tools. Nothing uploaded, ever.
Hash Generator
You are hereMD5, SHA-1, SHA-256, SHA-384 and SHA-512 from text or files
Diff Checker
Compare two texts or code files side by side
JWT Decoder
Decode JSON Web Tokens header and payload
Base64 & URL Encoder
Encode and decode Base64 and URL strings
JSON Formatter
Format, validate and minify JSON
Password Generator
Strong random passwords generated locally
Meta Tag Generator
SEO and social meta tags with live preview
Cron Expression Builder
Build and read cron expressions in plain English
Schema Markup Generator
JSON-LD schema for Article, Product, FAQ and more
How it works
- 1
Choose text or file
Switch between Text and File at the top of the tool. Text hashes what you type, File hashes the raw bytes of any file you drop in.
- 2
Read the five hashes
MD5, SHA-1, SHA-256, SHA-384 and SHA-512 are computed at once. Toggle uppercase or lowercase, and copy a single hash or all of them together.
- 3
Verify or sign
Paste a hash into the Verify box to see which algorithm produced it. Or turn on HMAC and enter a secret key to sign the same message with a shared secret.
Everything you get for free
Five algorithms in one page
MD5, SHA-1, SHA-256, SHA-384 and SHA-512 are computed in parallel. One paste gives you all five results at once.
Text and files
Hash any string you type or drop in any file, from a small text snippet to a multi-megabyte binary. Both run on the same page.
HMAC signing
Sign a message with a shared secret using HMAC-SHA-1, HMAC-SHA-256, HMAC-SHA-384 or HMAC-SHA-512. Useful for testing webhooks and API requests.
Verify mode
Paste a hash you were given and the tool highlights which algorithm produced it. No more guessing between MD5 and SHA-256 by length alone.
Live update as you type
The five hashes update as you type, with a 200 ms debounce so the page stays smooth even on long text.
Uppercase and lowercase output
One toggle flips every hash between lower-case hex and upper-case hex, so you can match the exact format an existing system expects.
Copy per hash or copy all
Copy a single algorithm result with one click, or copy all five in a labelled block ready to paste into a ticket or checksum file.
Zero upload, zero logging
Text and files are processed by JavaScript on your device. Nothing is sent to a server, nothing is stored, and there is no analytics on the content itself.
What people use it for
Verify downloaded files
Software releases and ISOs ship with a published SHA-256 checksum. Hash the download and compare it character by character before you install.
Check for duplicate files
Two files with different names can be identical. A SHA-256 hash of each tells you in seconds whether they are the same file or not.
Test webhooks and API signatures
Stripe, GitHub and most webhook providers sign their payloads with HMAC-SHA-256. Use this tool to reproduce and confirm the signature during development.
Store password verifiers
Instead of storing a password, some systems store its hash. Generate hashes of test strings to understand how a legacy login system works.
Data integrity checks
Publish a SHA-256 hash of a data export so downstream users can confirm the file they received matches the file you produced.
Cache busting for assets
Some build pipelines name assets with a short hash of their contents. Generate the same short hash here to confirm a cache-buster value.
Questions people ask
What is a hash function?
A hash function takes any input and returns a fixed-length string of characters that acts like a fingerprint. The same input always produces the same hash, but even a one-character change produces a completely different output. Hash functions are one-way: you cannot recover the original input from the hash.
Is the hash generator free?
Yes. Every algorithm is free to use with no sign-up, no watermark and no daily quota. ToolDeck may show ads to pay for hosting, but they never lock a feature.
Are my files or text uploaded to a server?
No. Everything runs inside your browser. Text is encoded as UTF-8 on your device, files are read with the FileReader API and hashed locally. Nothing is uploaded to ToolDeck or any third party.
Is there a file size limit?
There is no server side limit because nothing is uploaded. Very large files depend on your device memory. A few hundred megabytes of file is usually fine on a modern browser.
Which algorithm should I use?
For file integrity and modern security, use SHA-256. For signing webhooks or API requests, use HMAC-SHA-256. Use SHA-384 or SHA-512 if you want a bigger security margin. MD5 and SHA-1 are fine for non-security checksums and for reproducing legacy systems, but they are not safe against a determined attacker.
Is MD5 still safe?
MD5 is broken for security purposes. Practical collision attacks let an attacker craft two different inputs with the same MD5 hash. It is still useful for detecting accidental changes or duplicates, and for matching legacy values, but never use it for signatures or password storage.
Is SHA-1 still safe?
SHA-1 has been deprecated for security since around 2017 when a public collision was demonstrated. It is still used inside Git for object IDs and in some legacy systems, so generating a SHA-1 hash is useful for compatibility. It is not safe for new cryptographic designs.
What is HMAC and when should I use it?
HMAC is a construction that combines a hash function with a secret key, producing a signature that only someone with the key could have produced. It is used to authenticate webhook payloads, API requests and tokens. This tool supports HMAC with SHA-1, SHA-256, SHA-384 and SHA-512.
Why is HMAC-MD5 not offered?
The browser Web Crypto API does not implement HMAC-MD5, so an in-browser implementation would either be slow or would rely on a JavaScript MD5 that reimplements the whole HMAC construction. MD5 is also not a safe choice for HMAC in 2026, so the tool intentionally leaves it out.
Can I hash a file without uploading it?
Yes. That is exactly what this tool does. The FileReader API reads the file bytes into memory on your device, then the hash is computed locally. You can confirm this by watching the network tab while hashing.
Can I paste the hash into a checksum file?
Yes. The Copy all button produces one line per algorithm in the format ALGO: value. That is not the exact format of a .sha256 file but it is easy to convert. For a single algorithm, use the Copy button next to that algorithm.
Which browsers are supported?
Current versions of Chrome, Edge, Firefox and Safari, on desktop and mobile. The SHA family and HMAC use the browser Web Crypto API. MD5 is a pure JavaScript implementation that works everywhere.
Do you keep logs of my text or files?
No. There is no server side component and no logging of your content. The only thing that ever leaves your browser is an anonymous page view, if you have analytics consent enabled.
Your text and files never leave your browser
The MD5 implementation is pure JavaScript. SHA-1, SHA-256, SHA-384, SHA-512 and HMAC use the browser Web Crypto API. Files are read locally with the FileReader API. There is no server side hashing, no logging of your content and no analytics on the input itself. Read how we keep it private.