TrustComponent
Sign inGet started

Free developer tools

Hash Generator.

SHA-256, SHA-512, SHA-1 and MD5 for text or files — with HMAC support, computed entirely in your browser.

Developed and hosted in the EU
Hash Generator
5 algorithms · HMAC · files
Runs entirely in your browser
SHA-256
—
SHA-512
—
SHA-384
—
SHA-1 legacy
—
MD5 legacy
—
Hashes are computed with the Web Crypto API on your device — no uploads, no storage, no logging.

What a cryptographic hash does

A hash function turns any input — a word, a file, a hard drive — into a fixed-length fingerprint. The same input always produces the same hash, but the reverse direction is computationally impossible, and changing a single bit of input completely changes the output (the avalanche effect). Hashes verify integrity: if two digests match, the data is identical.

Not for passwords

Fast hashes like SHA-256 are the wrong tool for storing passwords — an attacker can try billions of candidates per second against a stolen database. Passwords belong in a deliberately slow, salted password hash: Argon2, bcrypt, or scrypt. If you need a strong password to begin with, try our password generator.

Where hashes are used

  • Download checksums — verify a file arrived intact and untampered.
  • Git — every commit ID is a hash of its content and history.
  • Digital signatures & certificates — documents are hashed, then the hash is signed.
  • Webhook & API signatures — HMACs prove a request came from the right sender.

The trailing-newline trap

The most common "wrong hash" mystery: your terminal's echo appends a newline, so it hashes different bytes than you think. This tool hashes exactly the characters you enter — matching printf %s or echo -n, not plain echo.

Hashing in your code

Command line
mind the newline
# echo adds a newline — this hashes "abc\n"
echo "abc" | sha256sum

# hash exactly "abc" (matches this tool)
printf %s "abc" | sha256sum

# hash a file
sha256sum document.pdf
JavaScript
Web Crypto API
const data = new TextEncoder().encode("abc");
const digest = await crypto.subtle.digest("SHA-256", data);

const hex = [...new Uint8Array(digest)]
  .map((b) => b.toString(16).padStart(2, "0"))
  .join("");

Frequently asked questions

Can I decrypt a hash back to the original text?
No. A cryptographic hash is a one-way function — the original data cannot be computed from the hash. Sites that claim to "decrypt" MD5 or SHA-256 actually look the hash up in giant tables of previously hashed values. That works only for common inputs like simple passwords, which is exactly why passwords need salted, slow hashing.
Which hash algorithm should I use?
SHA-256 is the safe default for integrity checks, signatures, and general use. SHA-512 is equally secure and can be faster on 64-bit systems. Avoid MD5 and SHA-1 for anything security-related — both are broken. For storing passwords, use none of these: use a dedicated password hash like Argon2 or bcrypt.
Is MD5 still safe to use at all?
Only for non-security purposes: cache keys, deduplication, or quick file comparison against accidental corruption. Collisions can be created deliberately, so MD5 must not be used for signatures, certificates, or password storage.
Why does my hash differ from the one my terminal produces?
Almost always a trailing newline. echo adds one, so echo "abc" hashes "abc\n" — a completely different digest. Use printf %s abc or echo -n abc instead. This tool hashes exactly what you type, without adding a newline.
What is an HMAC?
An HMAC combines a hash function with a secret key to create a message authentication code. Unlike a plain hash, only someone who knows the key can produce or verify it — used for webhook signatures, API request signing, and session tokens.
Why do I get the same hash for the same input every time?
That is the point: hashes are deterministic. The same bytes always produce the same digest, on any machine — which is what makes hashes useful for verifying that two files or messages are identical.
Is it safe to hash sensitive data on this page?
Hashing happens entirely in your browser via the Web Crypto API — your input is never transmitted, stored, or logged. You can verify this in your browser's network tab or use the page offline.

More free tools

All tools →
Base64 Encode / Decode

Convert text and files to and from Base64 — UTF-8 and URL-safe.

Open tool
URL Encode / Decode

Percent-encode and decode URLs and query parameters — live.

Open tool
JSON Formatter

Validate, pretty-print and minify JSON — with precise error locations.

Open tool

Free tools from a European software company.

  • Runs in your browser
  • Made & hosted in the EU
  • No account needed
Explore our products Browse resources