Hash Generator
Every common digest of your text at once, plus HMAC with a secret key. Computed in your browser as you type.
| Algorithm | Digest | |
|---|---|---|
| MD5 weak |
—
| |
| SHA-1 weak |
—
| |
| SHA-256 |
—
| |
| SHA-384 |
—
| |
| SHA-512 |
—
| |
| SHA3-256 |
—
| |
| SHA3-512 |
—
| |
| BLAKE2b-512 |
—
| |
| BLAKE3 |
—
|
Where your data goes
| Using this page | Using the API, MCP or A2A | |
|---|---|---|
| Where it runs |
In your browser. Digests are computed by the bundled @noble/hashes library in the page, recomputed on every keystroke. The HMAC key field is a normal text box in this page; it is never sent anywhere. | In a Cloudflare Pages Function at the Cloudflare data centre nearest the caller. |
| What leaves your device | Nothing you enter. After the page and its scripts load, no request
carries your input. The browser enforces this: the page's Content-Security-Policy
sets connect-src 'none' and form-action 'none', which
block fetch, XHR, WebSocket, EventSource, beacons and form posts.
| The server receives the data, hashes it in memory inside the request, and returns only digests. Your input is not stored or logged; only the per-call metadata row (operation, time, status, sizes) is recorded. Do not send secrets: hashing a secret on any server shares it with that server; use the page, which hashes locally. |
| Stored | Nothing leaves the page. No cookies, analytics or third-party scripts; the browser keeps only your View → Inline config choice. | Your inputs and results: never. What is stored is your client record (client ID, a SHA-256 hash of your secret, expiry, and the profile you registered with) and one metadata row per call: operation, time, transport, status, error code, duration, request and response sizes, and country. |
| Logged | Nothing (no requests are made). | Only the per-call metadata above, attributed to your client ID. Never parameters, bodies, results, or credentials. Cloudflare, as the host, also processes request metadata (IP address, full URL including the query string, headers) under its own policies, so put inputs in POST bodies. |
| Access | Open to anyone. | Requires a client ID and secret (how to get one). HTTPS only; TLS terminates at Cloudflare. |
Details and how to verify this yourself: Security & privacy.
User guide
The tool sits in a window that works like a desktop app: menus on the top row and the full-screen icon at its right (Esc leaves full screen). The set-up options described below are in Settings → Options…, an overlay, and the Settings menu also lists the common choices directly. To keep the options in view instead, choose View → Inline config; the page remembers that choice. Help → Keyboard shortcuts… lists the keys.
- Type or paste text. Every algorithm’s digest updates as you type.
- Choose Hex or Base64 output. Base64 is what SRI attributes (
integrity="sha384-…") and many APIs expect. - To compute an HMAC, tick HMAC with a secret key and enter the key. BLAKE3 is hidden in this mode (see below).
- Use Copy on any row.
For files, use File Hash Verification: it streams files of any size and compares the result to a published checksum.
Choosing an algorithm.
- New designs: use SHA-256 (or SHA-512, SHA3-256, BLAKE2b, BLAKE3). Any of them is fine.
- MD5 and SHA-1 are marked weak: practical collision attacks exist. They are here only to compare against checksums that were already published with them.
Matching a value from another tool. The text is hashed as UTF-8 exactly as typed, including any trailing newline. echo "abc" | sha256sum hashes abc\n, so use printf 'abc' | sha256sum (or echo -n) to match this page.
Specification
| ID | Algorithm | Digest size | Standard |
|---|---|---|---|
md5 | MD5 | 128 bits | RFC 1321 (collisions are practical) |
sha1 | SHA-1 | 160 bits | FIPS 180-4 (collisions are practical) |
sha256 | SHA-256 | 256 bits | FIPS 180-4 |
sha384 | SHA-384 | 384 bits | FIPS 180-4 |
sha512 | SHA-512 | 512 bits | FIPS 180-4 |
sha3-256 | SHA3-256 | 256 bits | FIPS 202 |
sha3-512 | SHA3-512 | 512 bits | FIPS 202 |
blake2b | BLAKE2b-512 | 512 bits | RFC 7693 (unkeyed) |
blake3 | BLAKE3 | 256 bits | BLAKE3 specification (default output length) |
- Input. The page hashes the text’s UTF-8 bytes. The API also accepts raw bytes (
input_base64or a file upload). - HMAC is page-only. HMAC needs a secret key, and the server never accepts secrets, so the API offers plain digests only.
- HMAC.
- Construction: RFC 2104 / FIPS 198-1 with the selected hash. The key is the UTF-8 bytes of the key text; a key longer than the hash’s block size is hashed first, per RFC 2104.
- BLAKE3 has a native keyed mode instead of HMAC, so it is not offered in HMAC mode.
- BLAKE2b in HMAC mode is HMAC-BLAKE2b (block size 128 bytes). That is not BLAKE2b’s built-in keyed mode.
- Output.
- Hex is lowercase.
- Base64 is standard RFC 4648 with padding. For SRI, prefix it with the algorithm, e.g.
sha384-….
- Implementation.
@noble/hashes(audited, pure JavaScript). The page and the API run identical code, so their results always match.
API & MCP
The same logic is available over HTTP and as MCP tools. Unlike this page, these run on the server: see where your data goes.