How to use Hash Generator
- 1. Choose an algorithm. SHA-256 is the default for modern checksums. SHA-512 is stronger. MD5 and SHA-1 are for legacy compatibility only.
- 2. Paste text or drop a file. Text is encoded as UTF-8. Files are hashed from their raw bytes, not from a data URI string.
- 3. Optional HMAC. Provide a secret to compute HMAC-SHA (not MD5). The secret stays in memory in this tab.
- 4. Compare. Paste an expected digest to see a constant-time-style equality check and avoid visual near-misses.
About this tool
A cryptographic hash maps arbitrary bytes to a fixed-size digest. The same input always produces the same output; a small change in the input produces an unrelated digest. SHA-256, SHA-384, and SHA-512 are from NIST FIPS 180-4 and are available in the Web Crypto API. MD5 (RFC 1321) and SHA-1 are broken for collision resistance and should not be used for security, but they still appear in legacy checksums. PureDevKit computes all of these locally so you can checksum a file without uploading it.
Which algorithm should I use?
For new integrity checks and fingerprinting, use SHA-256 or SHA-512. Git moved the ecosystem toward SHA-1 historically; do not copy that for new security designs. MD5 is acceptable only when a third party already defined it (old ETags, CMS checksum fields) and collisions are not a threat model. Password storage is not a use case for a raw hash: use Argon2id, scrypt, or bcrypt with a salt. HMAC-SHA-256 is the right primitive when you have a secret and need integrity plus authenticity of a message.
Hex vs Base64 vs what Git shows
Most docs print hashes as lowercase hex. Base64 is shorter and shows up in HTTP headers (`integrity` uses base64 for SHA-256 in Subresource Integrity, with a `sha256-` prefix). Always compare using the same alphabet and the same letter case. This tool can emit hex or Base64 from the same digest bytes.
Files vs text
Hashing the string `hello` is UTF-8 bytes `68 65 6c 6c 6f`. Hashing a file named hello.txt depends on whether the file has a trailing newline or a BOM. Line endings (`\r\n` vs `\n`) change the digest. When a published checksum does not match, the usual cause is a different encoding, not a broken algorithm. File mode hashes the raw `ArrayBuffer` from disk (as the browser exposes it).
HMAC notes
HMAC (RFC 2104) mixes a secret key with the message. You need the same key to verify. Do not send the key to an online HMAC site. HS256 JWTs are HMAC-SHA-256 over the first two segments; the JWT debugger can verify those with a secret as well. This panel is the general-purpose version for arbitrary messages.
Code examples
Web Crypto
const buf = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(text));
const hex = [...new Uint8Array(buf)].map(b => b.toString(16).padStart(2, "0")).join("");Node
import { createHash } from "node:crypto";
createHash("sha256").update(text).digest("hex");SRI
<script src="/app.js" integrity="sha256-..." crossorigin="anonymous"></script>