Hash Generator
0 / 200,000 characters
Max file 8.0 MB. MD5 and SHA-1 are checksums, not password storage — use bcrypt for passwords.
SHA-256 hex
Enter text or choose a file to hash.
SHA-256 Base64
Result appears here.
Online hash generator — MD5, SHA-256, HMAC, bcrypt
Looking for a hash generator, MD5 hash, SHA-256 tool, HMAC generator, or bcrypt checker? Toolshelf computes those digests in your browser so the message never needs to leave this device.
Paste text, optionally attach a small file, and copy hex or Base64. HMAC adds a key you type here. bcrypt is a separate mode for password hashing and compare — not a way to reverse SHA-256.
What you can do with this hash tool
- MD5, SHA-1, SHA-256, SHA-384, and SHA-512 of UTF-8 text
- HMAC with a secret key you type on this device
- bcrypt hash and compare with a capped cost factor
- Hash a small file entirely in the browser
- Hex and Base64 outputs with copy and download
- Honest labels: MD5 and SHA-1 are checksums, not password storage
- Draft text stays in this tab’s session storage — keys and passwords do not
- Nothing is uploaded
Hash vs HMAC vs bcrypt
Hash
One input, one digest. Useful as a checksum. MD5 and SHA-1 are labeled checksums because they are not safe for new security designs.
HMAC
Same idea plus a secret. Integrity with a key you already share. Not a login system and not JWT verification.
bcrypt
A password KDF with a work factor. Use this when the job is “hash a password”, not “checksum a file”.
Common uses
Checksum a string from logs
Paste a payload and compare its SHA-256 to a documented digest without sending the text to a hosted hasher.
Confirm a file did not change
Hash a small download in the browser and match the published SHA-256. Files over 8 MB are rejected so the tab stays usable.
Build an HMAC for an API fixture
Compute HMAC-SHA256 of a test body with a local secret. The key is not written to storage.
Store a password hash for local tests
Use bcrypt mode to hash a test password or compare a candidate against a $2b$ string. Cost is capped so the page cannot freeze forever.
See MD5 for legacy systems
Some older APIs still publish MD5 checksums. This page will compute them and labels MD5 as a checksum, not a password function.
Unicode-safe hashing
Text is hashed as UTF-8 bytes, so Hindi, emoji, and other Unicode match what a proper UTF-8 hasher produces.
Related tools
Encoding is not hashing — use the Base64 encoder for that. Inspect tokens with the JWT decoder. Generate secrets with the password generator.
Hash generator FAQ
- What is a hash generator?
- A hash generator turns text or file bytes into a fixed-length digest such as MD5 or SHA-256. This online hash generator runs in your browser so you can copy hex or Base64 without uploading the input.
- Is hashing the same as encryption?
- No. A hash is one-way. You cannot “decrypt” SHA-256 back to the original message. Encryption (AES, and similar) is a different job and is not this page.
- Should I store passwords with MD5 or SHA-256?
- No. MD5 and SHA-1 are broken for collision resistance and none of the SHA family is a password KDF by itself. Use the bcrypt mode on this page for password hashes, with a cost between 4 and 12.
- What is HMAC?
- HMAC is a hash-based message authentication code: a digest that also needs a secret key. Anyone with the same key can verify the message was not altered. This page does not authenticate a website or an API for you — it only computes the bytes.
- Does bcrypt compare send my password to a server?
- No. Toolshelf hashes and compares bcrypt strings locally. Passwords and HMAC keys are not written to localStorage or the URL. Non-secret text can stay in this tab’s session storage so refresh does not wipe the box.
- What happens if I hash an empty string?
- The empty-string SHA-256 is a well-known constant. This tool only shows a digest when you have typed text or chosen a file, so an unused page does not look like it hashed nothing by accident.
- Can I hash a large file?
- Files larger than 8 MB are rejected with a message. This is a browser tab, not a disk checksum utility for multi-gigabyte ISOs.
- Does this verify a JWT signature?
- No. HMAC here is a generic keyed digest of whatever you paste. To inspect a JSON Web Token, use the JWT decoder — decoding is still not signature verification.
- Why is bcrypt cost capped at 12?
- Each extra cost doubling roughly doubles CPU time. Cost 12 can already stall a phone tab for seconds. Higher values are rejected so the page stays responsive.
- Do I need an account?
- No. Toolshelf Hash Generator requires no account and no uploads.
Related tools
Continue with related browser-based tools on Toolshelf.
- Password Generator & Strength Checker — Generate strong random passwords and check password strength instantly.
- Base64 Encoder & Decoder — Online Base64 encoder and decoder.
- JWT Decoder & Inspector — Online JWT decoder and inspector.
- AES Encrypt Decrypt — AES encrypt decrypt online.
- JSON Formatter & Minifier — JSON formatter online: beautify, minify, and validate JSON in your browser.
- JSON to CSV Converter — Online JSON to CSV converter.
- Chmod Calculator — Chmod calculator online.
- Code Formatter & Beautifier — Online code formatter and beautifier.
Examples
SHA-256 of abc
The UTF-8 string abc hashes to ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad.
bcrypt compare
Paste a $2b$ hash and a candidate password. Compare stays in this browser.
Limitations
- MD5 and SHA-1 are checksums, not password storage.
- Files over 8 MB are rejected.
- bcrypt cost is capped at 12 so the tab stays usable.
- HMAC keys and bcrypt passwords are not saved on refresh.
Use cases
- For Developers — Format JSON, test regex, decode JWTs, and work with timestamps.
What would you like to do next?
Continue working with the next step in this workflow. Recently used tools in this set are listed first.
- Chmod Calculator — Chmod calculator online.
- Password Generator & Strength Checker — Generate strong random passwords and check password strength instantly.
- Base64 Encoder & Decoder — Online Base64 encoder and decoder.
- JWT Decoder & Inspector — Online JWT decoder and inspector.
You may also need
Continue with related browser-based tools on Toolshelf.
- Password Generator & Strength Checker — Generate strong random passwords and check password strength instantly.
- Base64 Encoder & Decoder — Online Base64 encoder and decoder.
- JWT Decoder & Inspector — Online JWT decoder and inspector.
- AES Encrypt Decrypt — AES encrypt decrypt online.
- JSON Formatter & Minifier — JSON formatter online: beautify, minify, and validate JSON in your browser.
- JSON to CSV Converter — Online JSON to CSV converter.
- Chmod Calculator — Chmod calculator online.
- Code Formatter & Beautifier — Online code formatter and beautifier.
Next steps
Related workflows on Toolshelf. These are curated paths, not usage rankings.
- Developer workflow — Format JSON, convert it to CSV, then inspect tokens.