Hash Generator (MD5, SHA-1, SHA-256, SHA-512, CRC32)
🔒 Runs in your browser
Choosing a hash algorithm
SHA-256 and SHA-512 are the modern, still-secure choice for file
integrity checks, checksums and general-purpose hashing. MD5 and
SHA-1 are kept here because legacy systems and old checksum files still use
them, but both are cryptographically broken: never rely on them for anything
security-sensitive, and never use any hash function alone to store passwords — a dedicated
slow, salted password hash (bcrypt, scrypt, Argon2) is required instead.
Files, HMAC, and what stays local
Text and file hashing run entirely in your browser: SHA-1/SHA-256/SHA-512
use the native Web Crypto API, while MD5 and CRC32 — which the
browser does not implement natively — use the hash-wasm library, loaded only
the moment you actually hash something. The HMAC tab combines a hash function with a secret
key so the result also proves a message was not altered by anyone lacking that key, useful
for verifying webhook signatures or API request authenticity.
Frequently asked questions
Which hash should I use?
SHA-256 (or SHA-512) is the standard choice today for file integrity checks and general-purpose hashing. MD5 and SHA-1 are fast but cryptographically broken — fine for legacy checksums, not for anything security-sensitive — and none of these algorithms should ever be used to store passwords: use a slow, salted password hash instead (bcrypt, scrypt, Argon2).
Is my file uploaded to a server?
No. Files are read and hashed entirely in your browser — SHA-1/256/512 via the Web Crypto API, MD5 and CRC32 via the hash-wasm library — nothing is transmitted or stored.
What is the HMAC tab for?
HMAC combines a hash function with a secret key, so the result also proves the message was not altered by anyone lacking that key — useful for verifying webhook signatures or API request authenticity, unlike a plain hash.
What is CRC32 good for?
CRC32 is a fast checksum used to catch accidental data corruption (e.g. in ZIP files or network protocols) — it is not cryptographically secure and must never be relied on to detect intentional tampering.