# Hash Generator

> MD5, SHA-1, SHA-2, SHA-3, BLAKE2b and BLAKE3 digests and HMACs of any text.

Category: Hashing · Page: https://util.caruana.me/tools/hash/

## API, MCP and A2A

### Hash (`hash`)

`GET|POST https://util.caruana.me/api/hash` · MCP tool `hash` · A2A skill `hash` · [reference](https://util.caruana.me/reference/hash/)

Computes MD5, SHA-1, SHA-256, SHA-384, SHA-512, SHA3-256, SHA3-512, BLAKE2b-512, BLAKE3 digests of the data. MD5 and SHA-1 are broken for collision resistance: use them only to match existing checksums. HMAC is deliberately not offered by the API, because it needs a secret key and this server never accepts secrets; compute HMACs on the page, which runs locally.

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `input` | string | no | Data as UTF-8 text. Use exactly one of `input`, `input_base64`, or a file upload. |
| `input_base64` | string | no | Data as Base64 (either alphabet), for binary content over JSON or MCP. |
| `algorithm` | list of all \| md5 \| sha1 \| sha256 \| sha384 \| sha512 \| sha3-256 \| sha3-512 \| blake2b \| blake3 | no | Comma-separated algorithm IDs, or `all`. IDs: `md5`, `sha1`, `sha256`, `sha384`, `sha512`, `sha3-256`, `sha3-512`, `blake2b`, `blake3`. |
| `encoding` | hex \| base64 | no | Digest output encoding: lowercase hex or standard Base64 with padding. |

Privacy: The server receives the data, hashes it in memory inside the request, and returns only digests. Your input is not stored or logged; only the per-call metadata row (operation, time, status, sizes) is recorded. Do not send secrets: hashing a secret on any server shares it with that server; use the page, which hashes locally.


## User guide

The tool sits in a window that works like a desktop app: menus on the top row and the **full-screen** icon at its right (**Esc** leaves full screen). The set-up options described below are in **Settings → Options…**, an overlay, and the **Settings** menu also lists the common choices directly. To keep the options in view instead, choose **View → Inline config**; the page remembers that choice. **Help → Keyboard shortcuts…** lists the keys.

1. Type or paste text. Every algorithm's digest updates as you type.
2. Choose **Hex** or **Base64** output. Base64 is what SRI attributes (`integrity="sha384-…"`) and many APIs expect.
3. To compute an HMAC, tick **HMAC with a secret key** and enter the key. BLAKE3 is hidden in this mode (see below).
4. Use **Copy** on any row.

For files, use [File Hash Verification](/tools/hash/verify/): it streams files of any size and compares the result to a published checksum.

**Choosing an algorithm.**

- **New designs:** use **SHA-256** (or **SHA-512**, **SHA3-256**, **BLAKE2b**, **BLAKE3**). Any of them is fine.
- **MD5** and **SHA-1** are marked _weak_: practical collision attacks exist. They are here only to compare against checksums that were already published with them.

**Matching a value from another tool.** The text is hashed as UTF-8 exactly as typed, including any trailing newline. `echo "abc" | sha256sum` hashes `abc\n`, so use `printf 'abc' | sha256sum` (or `echo -n`) to match this page.

## Specification

| ID         | Algorithm   | Digest size | Standard                                     |
| ---------- | ----------- | ----------- | -------------------------------------------- |
| `md5`      | MD5         | 128 bits    | RFC 1321 (collisions are practical)          |
| `sha1`     | SHA-1       | 160 bits    | FIPS 180-4 (collisions are practical)        |
| `sha256`   | SHA-256     | 256 bits    | FIPS 180-4                                   |
| `sha384`   | SHA-384     | 384 bits    | FIPS 180-4                                   |
| `sha512`   | SHA-512     | 512 bits    | FIPS 180-4                                   |
| `sha3-256` | SHA3-256    | 256 bits    | FIPS 202                                     |
| `sha3-512` | SHA3-512    | 512 bits    | FIPS 202                                     |
| `blake2b`  | BLAKE2b-512 | 512 bits    | RFC 7693 (unkeyed)                           |
| `blake3`   | BLAKE3      | 256 bits    | BLAKE3 specification (default output length) |

- **Input.** The page hashes the text's UTF-8 bytes. The API also accepts raw bytes (`input_base64` or a file upload).
- **HMAC is page-only.** HMAC needs a secret key, and the server never accepts secrets, so the API offers plain digests only.
- **HMAC.**
  - **Construction:** RFC 2104 / FIPS 198-1 with the selected hash. The key is the UTF-8 bytes of the key text; a key longer than the hash's block size is hashed first, per RFC 2104.
  - **BLAKE3** has a native keyed mode instead of HMAC, so it is not offered in HMAC mode.
  - **BLAKE2b** in HMAC mode is HMAC-BLAKE2b (block size 128 bytes). That is not BLAKE2b's built-in keyed mode.
- **Output.**
  - **Hex** is lowercase.
  - **Base64** is standard RFC 4648 with padding. For SRI, prefix it with the algorithm, e.g. `sha384-…`.
- **Implementation.** `@noble/hashes` (audited, pure JavaScript). The page and the API run identical code, so their results always match.