Skip to content
DevToolKits.app
Security

Hash & HMAC Generator

Generate cryptographic hashes (SHA-1, SHA-256, SHA-512) and HMAC signatures for your text data.

Use it to verify that a download matches a published checksum, to check a webhook or API signature against an HMAC you compute from a shared secret, or to compare how each algorithm transforms the same input.

All hashing runs locally in your browser, so the text and secret you enter are never sent to a server.

Guide: How to use & features

  • Paste text into the input field and choose a hash algorithm.
  • Provide a secret key when you need an HMAC output.
  • The output is shown in hexadecimal (hex) format.
  • Copy the result for API testing, signatures, or integrity checks.

Samples: Sample input & output

SHA-256 ハッシュ

Input

アルゴリズム: SHA-256
テキスト: hello

Output

2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824

FAQ: FAQ

  • What is the difference between a hash and an HMAC?

    A hash is computed from the input alone, so anyone can derive the same value from the same input. An HMAC also uses a secret key, so only parties who hold the key can produce or verify a valid signature. Use HMAC when, on top of detecting tampering, you want to confirm the sender holds the key.

  • Can I use SHA-256 to store passwords?

    Not recommended. SHA functions are fast, which makes them weak against brute-force attacks; password storage should use a deliberately slow, purpose-built function like bcrypt or Argon2. The SHA/HMAC here are meant for integrity checks and signature verification rather than storing passwords.

  • Is SHA-1 still safe to use?

    Collision attacks against SHA-1 have been demonstrated, so it is discouraged for security-sensitive uses such as signatures or tamper detection — choose SHA-256 or stronger for anything new. SHA-1 is best limited to compatibility checks with existing systems or non-security checksums.

Use cases: Common use cases

  • Verifying downloaded file integrity

    Compare a checksum the publisher provides (such as SHA-256) against the hash you generate from your local file to confirm it was not corrupted or tampered with.

  • Checking webhook / API signatures

    Compute an HMAC-SHA256 from the received payload and a shared secret, then match it against the signature header the sender attached — a quick way to debug your implementation.

  • Comparing output across algorithms

    Switch between SHA-1, SHA-256, and SHA-512 on the same input to see the difference in length and value, helping you pick the algorithm a spec calls for.

Notes: Notes & limitations

  • Work stays in your browser

    Inputs and outputs remain local. Closing the tab or clearing cache will remove any temporary state.

  • Validate critical data

    Results are helper outputs—double-check them before sending to production systems or sharing externally.

  • Large payloads depend on your device

    Very large text or files can feel slow in some browsers. Use a desktop environment for heavy workloads.

Configuration

Hash Algorithm

Hash and HMAC Generator

Hash functions and HMAC signatures are used to verify integrity, compare data, sign webhook payloads, and debug authentication flows. This tool helps generate common SHA hashes and HMAC values in the browser from text input.

Common use cases

  • Verify file or payload integrity: Compare expected and actual hash values during debugging.
  • Debug webhook signatures: Recreate HMAC values from a payload and shared secret.
  • Generate test fixtures: Prepare sample hashes for documentation, tests, or API examples.

Security note

Plain hashes are not suitable for storing passwords without a dedicated password hashing algorithm and salt. HMAC secrets and production payloads should be handled carefully and should not be shared in public examples.

Articles for this tool

Introduction
2026-02-16

JWT Security Deep Dive: Attack Vectors, JWKS, and Production Best Practices

A thorough guide to JWT security — covering the alg:none attack, algorithm confusion, key management with JWKS, token revocation strategies, and a production-ready security checklist.

Introduction
2026-01-21

Hashing, Salt, and HMAC: A Developer's Guide to Secure Data Handling

Learn how SHA-256, bcrypt, and Argon2 work, why salting passwords is non-negotiable, when to use HMAC vs. plain hashing, and practical implementation patterns in JavaScript, Python, and Go.

Use Case
2026-06-19

Encoding vs Hashing vs Encryption: The Difference and When to Use Each

Base64 encoding, SHA-256 hashing and encryption are constantly confused, yet serve completely different purposes. A comparison table, concrete examples, and the right choice for each use case.

Recent Articles

Use Case
2026-08-04

CREATE TABLE Reference: MySQL vs PostgreSQL vs SQLite Types & Constraints

A cross-database CREATE TABLE (DDL) reference with cheat sheets for data types, auto-increment keys (AUTO_INCREMENT / IDENTITY / rowid), foreign key ON DELETE behavior, and the CHECK constraint that MySQL silently ignores.

Introduction
2026-08-03

How CREATE TABLE Generation From a Visual Table Design Works | DDL Builder

A look inside DDL Builder, which turns a visually designed table into CREATE TABLE statements and an ER diagram. Covers the MySQL/PostgreSQL/SQLite type-mapping rules and the column-inference algorithm used for JSON samples.

Use Case
2026-07-21

GitHub Actions needs Design Patterns: Speed Up CI, Avoid the Anti-Patterns

A pattern reference for GitHub Actions job dependencies (needs). Covers diamond-shaped fan-out, concurrency cancellation, fail-fast tradeoffs, matrix-plus-needs gotchas, and reusable workflows, with copy-paste YAML examples.

Use Case
2026-07-21

SQL JOIN Types: Complete Reference to INNER, LEFT, RIGHT & FULL

A reference for SQL JOIN types (INNER/LEFT/RIGHT/FULL/CROSS/SELF) with a cheat sheet and row-count walkthroughs. Covers why one-to-many joins duplicate rows, the WHERE-vs-ON NULL trap, and how to write multi-table joins.

Introduction
2026-07-16

Case Converter: camelCase, snake_case & kebab-case — 9 Styles at Once

Convert identifiers between camelCase, PascalCase, snake_case, CONSTANT_CASE, kebab-case and more — all nine styles side by side. Handles acronym runs like HTTPServer, digits, and bulk multi-line conversion.

Introduction
2026-07-16

LLM API Cost Calculator: Compare Claude, GPT & Gemini Pricing Side by Side

Paste a prompt, set the expected output tokens, and compare per-request API costs across Claude, GPT and Gemini models. Covers input/output pricing structure, auto-updated price tables, and estimate limits.

Ad

Stay within DevToolKits with shortcuts to the most-used utilities across the site.

Articles
1
Article Index
AI & LLM
3
AI Rules Generator LLM Token Counter LLM API Cost Calculator
Development & DevOps
9
GitHub Actions Visualizer SQL Formatter Visual SQL Builder DDL Builder SQL → ER Diagram cURL Converter chmod Calculator Cron Editor & Parser Infrastructure Diagram Builder
Data Conversion & Schemas
6
JSON Formatter JSON → TypeScript JSON → Zod JSON → OpenAPI JSON ⇔ YAML CSV ⇔ JSON Converter
Security & Cryptography
5
Base64 / 58 / 32 JWT Tool Hash & HMAC Generator JWKS Generator UUID Generator
Text & Code Helpers
5
Markdown Table Generator Text & Code Suite Regex Tester Diff Viewer Case Converter
URL, QR & Network
5
URL Encode / Decode IP / CIDR Calculator URL Params → JSON QR Generator QR Reader
Design & UI
2
Color Utility Favicon Generator
Date & Time
3
Time Zone Converter Time Units UNIX Timestamp Converter

Ad