Hash & HMAC Generator
Hash text with seven algorithms at once, in hex and base64. Add a key to get HMAC instead, which is what you want whenever a secret is involved.
Not for passwords
These are fast by design, which is exactly wrong for a password. Use bcrypt, scrypt or Argon2 there — they are slow and salted on purpose. A fast hash over a password can be brute-forced at billions of guesses a second.
Same thing, as an API
curl -X POST 'https://akifakkaya.com/api/v1/tools/hash' \
-H 'Content-Type: application/json' \
-d '{"text":"The quick brown fox jumps over the lazy dog","algorithms":["md5","sha1","sha256","sha512"],"hmac_key":null}'Free, no key, 120 requests a minute. Full endpoint reference
Digests
Type something to hash it.
About this tool
Seven digests of the same input, side by side, in hex and base64. Seeing them together answers the question people usually arrive with — which one is this? — because a 32-character hex string is MD5, a 40-character one is SHA-1, and a 64-character one is SHA-256, and the widths are easier to recognise next to each other than from memory.
Each algorithm carries a line about where it still belongs. MD5 and SHA-1 are broken for anything adversarial and entirely fine as a cache key or a content address; SHA-256 is the default worth reaching for; BLAKE2b is faster than SHA-2 in software. None of them is a password hash: passwords need bcrypt, scrypt or Argon2, which are slow on purpose, and a fast hash over a password is a vulnerability rather than a shortcut.
Setting a key switches the whole panel to HMAC. That distinction matters more than it looks: HMAC is not the hash of the key and the message stuck together — that construction is vulnerable to length extension on SHA-2, which is the reason HMAC exists at all. If you are computing a webhook signature by hand, this is the panel to compare yours against.
Questions
- Can I use this to hash passwords?
- No. Use bcrypt, scrypt or Argon2. Those are deliberately slow and salted per password; a fast general-purpose hash over a password can be brute-forced at billions of guesses per second on commodity hardware.
- What is the difference between a digest and HMAC?
- A digest is a fingerprint of the message. HMAC is a keyed fingerprint: without the key you cannot produce or check it. Webhook signatures — Stripe, GitHub, Slack — are HMAC-SHA256 over the raw request body.
- Why does my HMAC not match the one my provider sent?
- Nearly always one of three things: the signed payload is the raw body rather than a re-serialised version of it, the key is hex or base64 that needs decoding to bytes first, or a timestamp is prefixed to the body before signing. Compare against the raw string this tool is given.
- Is MD5 usable for anything?
- For non-adversarial uses, yes — checksums, cache keys, deduplication. Not for signatures, certificates or anything where someone benefits from a collision, which have been practical to construct since 2004.