Hashing runs entirely in your browser. Files and text are never uploaded.
What is a hash generator?
A hash generator turns text or file bytes into a fixed-length fingerprint. Hashes are commonly used to verify downloads, compare files, build cache keys, store non-reversible identifiers and sign payloads. DevFormatLab supports legacy MD5, SHA-1 and modern SHA-2 algorithms including SHA-256, SHA-384 and SHA-512. MD5 and SHA-1 are useful for compatibility and checksums, but they are no longer collision-resistant for security-sensitive use. For integrity or signing workflows, prefer SHA-256 or stronger, and use HMAC when a secret key is required.
Features
- Generate MD5, SHA-1, SHA-256, SHA-384 and SHA-512
- Hash typed text or a local file without uploading it
- Optional HMAC for SHA-1 / SHA-256 / SHA-384 / SHA-512
- Uppercase / lowercase hex output
- Copy any digest with one click
- 100% browser-based — your files never leave your device
How to use
- Type or paste text into the input panel, or choose a file with Open file.
- All hashes update automatically. Large files are read locally by the browser File API.
- Enter an HMAC key if you need keyed SHA digests. MD5 HMAC is intentionally not provided.
- Copy the digest you need, or toggle uppercase to match another system's output format.
Frequently Asked Questions
Are files uploaded to the server?
▾
No. Files are read with the browser File API and hashed locally. The server never receives file contents, filenames or generated digests.
Which algorithm should I use?
▾
Use SHA-256 for general integrity checks and modern systems. SHA-512 is also strong and often fast on 64-bit CPUs. MD5 and SHA-1 are included for compatibility with older checksum formats, not for security.
What is HMAC?
▾
HMAC combines a hash algorithm with a secret key. It proves that the party generating the digest knew the key and that the message was not changed. Use HMAC-SHA-256 or stronger for API signing workflows.
Why is MD5 still included?
▾
Many download pages and legacy systems still publish MD5 checksums. It is fine for accidental corruption checks, but it should not be used to protect against attackers.
Related tools
Format, minify, validate and beautify JSON with inline error highlighting.
Compare two JSON documents side-by-side with line-level highlighting and key sorting.
Remove duplicates, empty rows, trim whitespace, convert UTF-8 ↔ Shift-JIS.
Convert YAML ↔ JSON and YAML ↔ Java .properties with strict validation.
Encode and decode Base64 (and Base64URL) for text or files. Real-time, browser-only.
Encode and decode URLs, query strings and URI components with percent-encoding and form-style spaces.
Convert Unix timestamps (seconds or milliseconds) to and from human-readable dates across timezones.
Decode JSON Web Tokens to inspect header, payload and signature, with readable timestamps and expiry status.
Test regular expressions in real time with match highlighting and presets.
Canonical: https://devformatlab.com/en/hash-generator