Hash Generator
Real digests, computed on your machine: MD5, SHA-1, SHA-256, SHA-384, SHA-512 and HMAC-SHA-256, for typed text or a dropped file. This is the tool for the job an AI chat is worst at — a chatbot asked for a hash will invent a string that looks perfect and matches nothing, because it predicts text instead of computing. Here the algorithms actually run, the file is never uploaded, and the answer is the digest, not a guess at one.
- MD5
- —
- SHA-1
- —
- SHA-256
- —
- SHA-384
- —
- SHA-512
- —
- HMAC-SHA-256
- Enter a key to compute the HMAC of the text or file above.
Why a computed hash and an invented one look identical
A hash is a fingerprint with a peculiar property: change one bit of the input and roughly half the output bits flip. There is no "close" in hash space, no pattern a text predictor can ride — the 64 hex characters of a SHA-256 are, to any model that has not actually run the algorithm, indistinguishable from random. So a chatbot does the only thing it can do: it produces 64 random-looking hex characters, formatted perfectly and wrong completely. People have shipped release notes, verification instructions and incident reports containing such inventions, because nothing about the string looks fake. The defence is boring and total: never accept a digest from anything that cannot show its working. This page shows its working by construction — MD5 is implemented from RFC 1321 in the open (WebCrypto omits MD5 deliberately, so a page that offers it either wrote it or is faking), the SHA family runs through the browser’s own WebCrypto, and dropped files are read with the local File API and hashed where they sit. Nothing is uploaded, which matters because the files people hash are so often the sensitive ones: a firmware image under NDA, a database dump, the exact binary from a production host.
Two neighbours complete the set. If what you hold is a hash and the question is "what made this?", the hash identifier reads its length, alphabet and prefix and names the candidates — honestly, including the ones shape cannot separate. And because the other classic confusion is reversible versus one-way, the article Base64 is not encryption separates encoding (reversible, no key), encryption (reversible, with a key) and hashing (one-way, no key) — the three ideas whose mix-ups fill breach reports. For checking a live server’s certificates instead of a file, the SSL checker and SSL grader do the network side of the same job.
Frequently asked questions
Can an AI chatbot just hash this for me?
It can hand you a string that looks exactly like a hash — 64 confident hex characters for SHA-256 — and that string will be invented. A language model does not compute digests; it predicts text, and a hash is the one kind of text where "plausible" and "correct" share nothing. It also cannot hash a file it cannot read. This page computes the real digest on your own machine, with the same algorithms your operating system uses — and if the input is a file, the file never leaves the browser. The flagship article, never let a chatbot do your secrets, walks through all three failure modes.
Why is MD5 here if it is broken?
Because the world still publishes MD5 checksums. Vendor download pages, legacy systems, old database dumps and a decade of forum posts use MD5 as a fingerprint, and checking a download against its published MD5 requires producing a real MD5 — which WebCrypto refuses to do, so the implementation on this page is written from RFC 1321 and pinned to the RFC’s own test vectors. Broken for collision resistance means broken for security decisions; it does not erase the installed base. Use it to verify legacy fingerprints, never to protect anything new.
What is HMAC, and why does it need a key?
A plain hash proves a message matches a digest; it does not prove who made it, because anyone can hash anything. HMAC mixes a secret key into the construction, so the digest also authenticates the sender — that is how webhooks and signed API requests prove themselves. Enter the same text and key here and you get the value your code should produce, computed locally, so a production webhook secret never has to be pasted into a chat or a stranger’s server to be debugged.
Should I hash a password with one of these?
No. These are fast general-purpose digests, and fast is exactly what a password hash must not be — an attacker with a GPU tries billions per second. Passwords belong in bcrypt, scrypt or Argon2, which are deliberately slow and salted. If you have a hash and want to know what produced it, the hash identifier reads its shape; if you need a new password, the password generator makes one locally.
Uppercase or lowercase hex — does it matter?
Not to the digest: hex is a notation, and A-F versus a-f is typography. It matters to comparisons, because a byte-for-byte string compare will call the same hash different. The toggle rewrites every output at once so you can match the format of the checksum you are comparing against — most Unix tools print lowercase, some Windows tools print uppercase.