Generate Cryptographic Hashes Instantly
Whether you are verifying file integrity, signing API requests or storing passwords safely, cryptographic hashes are the backbone of modern security. Our Hash Generator is a free, browser-based tool that computes six different hash algorithms simultaneously from any text you type. No server calls, no data stored and no libraries to install.
What Is a Hash Function?
A hash function takes any input, no matter how long and produces a fixed-length string of characters. The same input always produces the same output, but even a tiny change to the input creates a completely different hash. This "avalanche effect" is what makes hashes so useful for security.
The Six Algorithms We Support
SHA-256 is the industry standard. It produces a 64-character hex string and is used in SSL certificates, Bitcoin, Git and countless other systems. If you only need one hash, this is the one.
SHA-512 is the big brother of SHA-256. It produces a 128-character output and offers a larger security margin. It is preferred for high-security applications and is often faster than SHA-256 on 64-bit processors.
MD5 produces a 32-character hash. While it is cryptographically broken (collisions can be generated), it remains widely used for checksums, cache keys and legacy system compatibility. We include it because you will encounter it everywhere.
PBKDF2 (Password-Based Key Derivation Function 2) is designed specifically for password hashing. It intentionally runs slowly by repeating the hash function many times (100,000 iterations in our case) to make brute-force attacks impractical.
HMAC-SHA-256 combines SHA-256 with a secret key to create a message authentication code. It proves that a message was sent by someone who knows the key and that it was not tampered with in transit.
HMAC-SHA-512 is the same concept as HMAC-SHA-256 but uses SHA-512 internally for a larger output and higher security margin.
When to Use Each Algorithm
| Algorithm | Output Size | Best For |
|---|---|---|
| SHA-256 | 256 bits (64 hex chars) | General-purpose integrity checks, digital signatures |
| SHA-512 | 512 bits (128 hex chars) | High-security applications, 64-bit systems |
| MD5 | 128 bits (32 hex chars) | Checksums, cache keys, legacy compatibility |
| PBKDF2 | Configurable (512 bits here) | Password storage, key derivation |
| HMAC-SHA-256 | 256 bits (64 hex chars) | API authentication, webhook signatures |
| HMAC-SHA-512 | 512 bits (128 hex chars) | High-security message authentication |
How We Compute These Hashes
We use the browser's native Web Crypto API (crypto.subtle) for SHA-256, SHA-512, PBKDF2 and both HMAC algorithms. This is the same cryptographic engine that powers HTTPS in your browser, so the results are identical to what any server or command-line tool would produce.
For MD5, since the Web Crypto API does not support it (because it is considered insecure), we use a pure JavaScript implementation based on the original RFC 1321 specification. It runs entirely in your browser with no external dependencies.
PBKDF2 Parameters
Our PBKDF2 implementation uses a fixed salt of "tooltri-pbkdf2-salt", 100,000 iterations and SHA-512 as the underlying hash. In a production system, you would use a unique random salt per user. We use a fixed salt here so you can reproduce and verify results consistently.
Your Data Never Leaves Your Browser
Privacy is fundamental. Every hash computation happens locally using your browser's built-in cryptographic APIs. We do not send your text to a server, we do not store your secret keys and we do not log your hashes. Once you close the tab, the data is gone. It is completely safe for passwords, API secrets and sensitive documents.