Security
Hash Generator & Checksum Calculator (SHA-256, SHA-512, MD5)
Calculate cryptographic message digests and keyed HMAC signatures locally in your browser. Computes SHA-256, SHA-512, SHA-384, SHA-1, and MD5 in real time with hex, uppercase hex, and Base64 output formatting alongside automated checksum verification.
Standard unkeyed cryptographic digests.
How it works
Cryptographic hash functions process arbitrary-length input strings and compress them into fixed-length deterministic message digests. The Web Crypto API (`crypto.subtle.digest`) computes SHA-256 (256-bit / 32-byte digest), SHA-512 (512-bit / 64-byte digest), SHA-384, and SHA-1 in compiled browser native code. For legacy checksums, a pure JavaScript RFC 1321 MD5 engine computes the 128-bit hash. When a secret key is provided, the tool implements HMAC (Hash-based Message Authentication Code, RFC 2104) via `crypto.subtle.sign('HMAC')`, verifying message authenticity and integrity against forgery.
How to use it
- Type or paste your text, JSON payload, or binary data string into the source area.
- To generate a keyed HMAC signature (for Stripe, Razorpay, or GitHub webhooks), enter your shared secret key into the HMAC field.
- Select your preferred output encoding: Hexadecimal (lowercase), Hexadecimal (UPPERCASE), or Base64.
- Optionally paste an expected checksum into the comparison box to automatically verify file or message integrity.
- Copy individual algorithm digests (SHA-256, SHA-512, SHA-384, SHA-1, MD5) with one click.
Worked Examples
Example 1: Verifying Webhook Signatures (Stripe / GitHub)
Worked ExampleTesting an HMAC-SHA-256 signature generated by a payment gateway against an incoming raw HTTP request body.
Input Payload
Payload: '{"id":"evt_101","amount":2500}' | Secret: 'whsec_test_987'Output / Result
HMAC-SHA-256: 4b68e9832729a8d9a4f61f76269ebfeea31889759b8a59f5beec0dc25785a3c6
Why this happens: Allows developers to visually confirm their backend webhook signature verification logic using identical raw byte inputs.
Example 2: Validating Software Download Checksums
Worked ExampleConfirming that a downloaded Linux ISO or Docker tarball matches the vendor's published SHA-256 checksum.
Input Payload
Expected Checksum: 'e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855'
Output / Result
Result: ✓ Checksum Matches Output (SHA-256 match confirmed)
Why this happens: Instantly verifies file integrity, ensuring the downloaded asset has not been corrupted or tampered with in transit.
Example 3: Generating Gravatar Email Hash
Worked ExampleCreating an MD5 hash of a trimmed, lowercased user email address to fetch their Gravatar profile avatar.
Input Payload
[email protected]
Output / Result
MD5: 64e0ad88220ceee050eeefbb4a5bdf35
Why this happens: Computes the standard MD5 hex digest required by Gravatar URL schemas (https://www.gravatar.com/avatar/{md5}).
Edge Cases & Failure Modes
MD5 and SHA-1 Collision Vulnerabilities
MD5 and SHA-1 are cryptographically broken and vulnerable to collision attacks (where two different inputs produce the identical hash).
Handling: Never use MD5 or SHA-1 for digital signatures or password hashing. Use them solely for non-cryptographic checksum verification and legacy compatibility; use SHA-256 or SHA-512 for security applications.
Whitespace Sensitivity in Webhook Bodies
A single added newline or space in an HTTP POST body changes the entire SHA-256 hash output via the avalanche effect.
Handling: Always verify HMAC signatures against the raw, unparsed request byte buffer rather than re-stringified JSON objects.
Character Encoding Discrepancies (UTF-8 vs ASCII)
Hashing strings containing multibyte UTF-8 characters under naive ASCII byte conversion produces mismatched digests across programming languages.
Handling: Our generator encodes strings via standard UTF-8 TextEncoder bytes, guaranteeing identical digests across Node.js, Python, Go, and Java backends.
Privacy & Local Execution Guarantee
All hash digests and HMAC calculations use the browser's hardware-accelerated Web Crypto API (SubtleCrypto) and local JavaScript. Your input payloads, API webhook bodies, and secret keys never touch any server or external API.
Frequently Asked Questions
Can a cryptographic hash be decrypted back to the original text?
No. Cryptographic hash functions are one-way mathematical transformations. Unlike encryption, there is no decryption key. You cannot mathematically reverse a SHA-256 hash back into the original message.
What is an HMAC and why is it used for API webhooks?
HMAC (Hash-based Message Authentication Code) combines a cryptographic hash function with a shared secret key. It proves that the payload was sent by an authentic sender who possesses the secret key and that the content was not altered in transit.
What is the difference between SHA-256 and SHA-512?
SHA-256 produces a 256-bit (32-byte / 64 hex character) digest, while SHA-512 produces a 512-bit (64-byte / 128 hex character) digest. SHA-512 offers a higher security margin against quantum attacks and often runs faster on 64-bit CPU architectures.
Why should passwords never be hashed with plain SHA-256?
SHA-256 is designed for high-throughput speed (billions of hashes per second on modern GPUs), making brute-force dictionary attacks easy. Passwords should only be hashed using intentionally slow, memory-hard algorithms such as Argon2id or bcrypt.
Are payloads or secret keys sent across the network?
No. All hashing and HMAC signatures are computed locally inside your browser using the native Web Crypto API. Nothing is transmitted to any server.
Related articles
Related tools
Related services
Next step
Need this wired into a real system?
Estimators and converters help you think. Delivery still needs contracts, environments, and an owner.