Hash Generator

A hash generator converts input bytes into a fixed-length digest using a hash algorithm. The same input and algorithm always produce the same digest, making hashes useful for integrity checks, file verification, fingerprinting, and compatibility workflows. Hashing is not encryption — a digest cannot be decrypted to recover the original input.

The unified workspace calculates MD5, SHA-1, SHA-256, SHA-384, and SHA-512 from the same text or local file input. Results appear together so you can compare output length, verify a known checksum, and choose the right algorithm for your workflow without switching pages.

Yes. One input is processed with all five algorithms in the browser simultaneously using Promise.all. Each digest has its own copy button. The side-by-side layout is ideal when a download page, API, build system, or legacy integration expects a specific algorithm and you want to confirm outputs across all of them.

Yes. Select the Local file tab and choose any file from your device. The browser reads the file bytes locally using FileReader.readAsArrayBuffer() and computes all five digests in memory. ToolsSonic does not send any bytes to a server, API endpoint, or browser storage.

They differ in output size and security status. MD5 produces 128 bits (32 hex chars) and is cryptographically broken. SHA-1 produces 160 bits (40 hex chars) and is deprecated for security use. SHA-256 produces 256 bits (64 hex chars) and is the current general-purpose standard. SHA-384 produces 384 bits (96 hex chars) and is used in certain TLS cipher suites. SHA-512 produces 512 bits (128 hex chars) and is preferred for high-security contexts and PBKDF2 key derivation.

No. MD5 and SHA-1 are retained here for legacy compatibility and checksum comparison only. Practical collision attacks have been demonstrated against both — the Flame malware forged an MD5 certificate, and Google's SHAttered project found the first practical SHA-1 collision in 2017. Use SHA-256 or SHA-512 for any new security design.

No. A plain SHA-256 digest is not a password-storage function. SHA-256 is designed to be fast — that is the wrong property for passwords, which need deliberate slowness to resist brute-force attacks. Use Argon2id, bcrypt (cost ≥ 12), or scrypt for password hashing. SHA-256 is appropriate for integrity checks, digital signatures, and API authentication.

Hash functions are designed to be one-way. However, weak or common inputs can be looked up in precomputed rainbow tables. A digest is not secret — it is a fingerprint. Never paste passwords, private keys, or confidential data into a shared device, and never treat a hash as a substitute for encryption.

Yes. Generate the digests, select the algorithm in the Checksum Verification section, paste the expected hexadecimal value, and click Verify. The tool reports whether the expected value exactly matches the generated result after stripping whitespace. This is the standard workflow for verifying downloaded software.

Yes. Text input is encoded as UTF-8 bytes using TextEncoder before hashing, so accented characters, non-Latin scripts, and emoji produce correct results. Be aware that visually identical strings with different Unicode normalisation (NFC vs NFD) or hidden whitespace will produce different digests.

Yes. Copy an individual digest with its card button, copy all five results at once, or click Download report to save a plain-text checksum file named after your input. The file contains algorithm names and hex outputs only — not your original content.

Yes. The workspace runs entirely in your browser with no account, no server upload, and no persistent input storage. SHA-1, SHA-256, SHA-384, and SHA-512 use the native Web Crypto API (crypto.subtle.digest). MD5 uses a local pure-JavaScript RFC 1321 implementation. Nothing is transmitted or logged.

Yes. Enter a secret key in the HMAC panel and choose SHA-256, SHA-384, or SHA-512. The keyed digest of your text input is computed with the browser Web Crypto API — the key never leaves this page. HMAC is what APIs and webhooks (for example Stripe and GitHub signatures) use to authenticate messages.

A plain hash proves two inputs are identical, but anyone can compute it. An HMAC mixes a secret key into the hash, so only parties that know the key can produce or verify the value — that is what makes it suitable for API request signing and webhook verification.