Contact

Tools  /  Security  /  Hash Generator

SECURITY

Hash Generator

MD5, SHA-1/256/384/512 and CRC32, with HMAC, salting, batch mode and file hashing — all on your machine.

More Security tools

Basic Auth Generator Bearer Token Builder Password Strength Checker Passphrase Generator Certificate / DER Structure Viewer PEM Formatter

What this tool does

Paste text or drop in a file and get its hash instantly — MD4, MD5, NTLM, SHA-1, SHA-256, SHA-384, SHA-512, or the non-cryptographic CRC32 and Adler-32 checksums, all computed side by side so you can compare them at a glance. Beyond a single hash, it also supports HMAC (a keyed hash for verifying authenticity, not just integrity), optional salt and pepper text added before hashing, a batch mode that hashes every line of pasted text separately in one pass, hashing multiple files at once (handy for checking a whole folder of downloads against published checksums), and a session-only history of everything you've hashed.

Which algorithm should I use?

SHA-256 is the right default for almost everything — checksums, file integrity, fingerprinting data, Git-style content addressing. SHA-384 and SHA-512 exist for when a longer digest is specifically required. MD5 and SHA-1 are still here because plenty of legacy systems (old file checksums, some APIs, some caching schemes) still use them, but neither should be trusted for anything where someone might deliberately try to forge a collision — both are broken in that sense. MD4 is older still and almost never used directly today, but it's the building block NTLM is made from. NTLM itself is Windows' password hash format (MD4(UTF-16LE(password))) — relevant for security coursework and CTF challenges involving a dumped SAM or NTDS.dit, not for hashing anything of your own. CRC32 and Adler-32 aren't cryptographic hashes at all; they're fast checksums designed to catch accidental corruption (a bad download, a flaky disk) — CRC32 is what ZIP and PNG use internally, Adler-32 is what zlib uses — don't use either anywhere security matters.

HMAC, salt, and pepper

HMAC turns a hash into a keyed, authenticated hash: instead of just proving data hasn't changed, it proves whoever produced it had the secret key — that's what a webhook signature or an API request signature actually is. It's offered for every algorithm here except CRC32, Adler-32 and NTLM, none of which are keyed constructions. Salt (added before the input) and pepper (added after) are plain text mixed into the input before hashing — useful for understanding how password-hashing schemes work, or for quickly reproducing a hash that was built with a known prefix or suffix. For real password storage, use a dedicated slow hash like bcrypt or Argon2, not a raw hash with a salt — this tool is for understanding and testing, not for storing production passwords.

Batch mode, multi-file hashing, and history

Batch mode treats each line of the input as a separate thing to hash — paste a list of words, tokens, or lines from a file and get one hash per line, each with its own copy button and a single download for the whole list. Hashing multiple files at once works the same way for actual files — select several and get a checksums file back (<hash> <filename> per line, the same format a SHA256SUMS file uses), ready to compare against a set of published checksums. File hashing (the single-file input above the algorithm tabs) reads the file directly in your browser (drag it onto the input or use the picker) — useful for verifying one download matches a published checksum, which the built-in verify field (paste a hash, or pick a second file to compare directly) checks for you automatically. The history panel keeps the last 8 hashes you've computed this session, for quickly getting back to one without recomputing it.

Privacy

Every hash is computed locally — the Web Crypto API where it offers the algorithm, and a from-scratch implementation for MD4, MD5, NTLM, CRC32 and Adler-32, none of which Web Crypto provides. The session history lives only in this tab's memory; it's never written to localStorage or sent anywhere, and it disappears the moment you leave or reload the page. Nothing you type or upload — including file contents — ever leaves your browser.

FAQ

Frequently asked questions

Is my text or file uploaded anywhere?
No. Hashing runs entirely in your browser via the Web Crypto API (plus a local implementation for MD4, MD5, NTLM, CRC32 and Adler-32, none of which Web Crypto provides) — nothing is sent to a server, including file contents.
Which hash algorithm should I use?
SHA-256 for almost everything. Reach for SHA-384/SHA-512 only if a longer digest is specifically required. MD5 and SHA-1 are kept for compatibility with legacy systems but are not collision-resistant — avoid them anywhere a forged match would matter. CRC32 is not a security hash at all; it's a fast checksum for catching accidental corruption.
What is HMAC and when do I need the key field?
HMAC combines a hash function with a secret key, so the result proves not just that data is unchanged but that whoever produced it knew the key — this is what webhook and API request signatures usually are. Turn on HMAC and enter the shared secret to reproduce or verify one.
Can I hash a file instead of text?
Yes — drag a file onto the input card or use the file picker. The hash is computed from the file's raw bytes, and switching back to typing text restores the text box.
What do salt and pepper do here?
Salt is text added before your input, pepper is text added after, both before hashing — useful for testing or reproducing a hash that was built with a known prefix or suffix. For real password storage, use a dedicated slow hash like bcrypt or Argon2 instead, not a salted general-purpose hash.
What does batch mode do?
It hashes each line of the input separately instead of treating the whole box as one input — paste a list and get one hash per line, each individually copyable, with a single button to download the full list as a text file.
How do I verify a hash matches?
Paste the expected hash into the Verify field for an instant match/no-match check, or pick a second file there to compare its hash directly against the first — useful for confirming a download wasn't corrupted or tampered with.
What is NTLM and why is it here?
NTLM is Windows' password hash format -- MD4 of the password encoded as UTF-16LE. It's included for security coursework and CTF work involving a dumped SAM or NTDS.dit, not as something to use for hashing your own data; it only applies to text input, not files.
Can I hash several files at once?
Yes -- the "Hash multiple files at once" section lets you select several files and get back a checksums file (hash and filename per line, the same format a SHA256SUMS file uses) in one go.
Is the hash history saved anywhere?
No -- it's kept only in this browser tab's memory for the current session, never written to disk or sent anywhere, and it disappears the moment you reload or leave the page.
Theme Accent