Hash Generator

A hash function takes any input — text, a file, a password — and produces a fixed-length string of characters called a digest. The same input always produces the same output, but even a single-character change produces a completely different hash. Hash functions are one-way: you cannot reverse a hash to recover the original input.

MD5 is considered cryptographically broken. Researchers demonstrated practical collision attacks in 2004, meaning two different inputs can produce the same MD5 hash. It should never be used for security purposes like password hashing or digital signatures. However, MD5 is still acceptable for non-security uses like checksum verification of known-good files or cache-busting keys.

Both are part of the SHA-2 family designed by the NSA. SHA-256 produces a 256-bit (32-byte) digest and SHA-512 produces a 512-bit (64-byte) digest. SHA-512 offers a larger security margin and can actually be faster on 64-bit processors because it operates on 64-bit words natively. Both are considered secure for all current applications.

HMAC (Hash-based Message Authentication Code) combines a hash function with a secret key to produce an authentication tag. Unlike a plain hash, HMAC proves both integrity and authenticity — only someone with the key can produce or verify the tag. Use HMAC when you need to verify that a message was not tampered with and came from a trusted sender, such as API webhook signatures or JWT tokens.

No. All hashing happens entirely in your browser using the Web Crypto API and a pure JavaScript MD5 implementation. Your text and files never leave your device. There is no server processing, no logging, and no storage.