Generate SHA digests and HMAC signatures in your browser
Hash a string with SHA-256, SHA-384 or SHA-512, or sign a payload with HMAC using your own secret. Every computation uses the browser crypto engine, so the value you hash never travels anywhere.
- Algorithms
- SHA-1 / 256 / 384 / 512
- HMAC
- Included
- MD5
- Not offered
Measured on Apple M4 Max: 0.50 ms sha-256 over the input (1.0 MB of text) See the benchmarks
How to use it
- Enter the value to hash Text is encoded as UTF-8 before hashing, so accented characters and emoji produce the digest you would get from a standard command line tool.
- Choose the algorithm SHA-256 is the default and the right answer for almost everything. SHA-512 is available when a protocol requires a wider digest.
- Optionally add an HMAC key With a key set, the tool switches to keyed hashing, which is what a webhook signature actually uses.
Questions people ask
Is SHA-1 still safe to use?
For a checksum, yes. For anything security-sensitive, no. SHA-1 has practical collision attacks, which is why Git moved to SHA-256 and why certificates stopped using it years ago.
Why do you not offer MD5?
Because it is the most common wrong answer on the internet. MD5 collisions can be produced deliberately and cheaply, so it is unsuitable for signatures and integrity checks against an adversary. If you need MD5 for a legacy system, SHA-256 is almost always accepted as well.
How is the digest formatted?
Lowercase hexadecimal by default, which is what sha256sum and most build systems print. You can switch the output to base64, which is what JWT and many API signatures use.
How do I verify a webhook signature?
Take the raw request body exactly as received, compute the HMAC with the endpoint secret and the algorithm the provider specified, then compare the result to the signature header using a constant-time comparison.
Can I hash a file?
The input here is text. For a multi-megabyte binary file, use your platform tooling — sha256sum on Linux, Get-FileHash on Windows, or shasum on macOS — rather than pasting bytes into a web form.
Does the tool keep a log of what I hash?
No, because there is no server. The page makes no network requests, so there is nothing to log.
Details that catch people out
MD5 is broken for collision resistance: two different inputs can be crafted to produce the same digest, which is why certificates, package signatures and git have all moved away from it. Adding it for legacy compatibility is reasonable, but it should never be your default, and a tool that lists it first is giving bad advice. SHA-256 is the default here.
A digest cannot be reversed, but it is also not a password store. For passwords you want a deliberately slow, salted algorithm such as Argon2, bcrypt or scrypt. A plain SHA-256 of a password is crackable at billions of guesses per second on a GPU.
Where this earns its keep
Verifying a file checksum
Compare the digest of a downloaded artefact against the value published in the release notes, in either direction.
Checking a webhook signature
Compute the HMAC of a raw request body with the endpoint secret and compare it to the signature header the provider sent.
Seeding deterministic test data
Hash a fixed string to get a stable identifier for fixtures, so the same input always produces the same value across machines.
Guides that go deeper
- How Webhook Signature Verification Works 8 min read · How to verify that a webhook really came from the provider: HMAC signatures, the raw body…
Last reviewed 2026-10-14. Every tool on DevSnap runs entirely in your browser, so whatever you paste here never reaches a server.