Why is there no MD5 option?

The Web Crypto API this tool relies on doesn't implement MD5, and since MD5 collisions are practical to produce, it isn't worth adding a separate library just to offer a broken algorithm.

What's the difference between hashing and HMAC here?

Plain hashing takes only your text and produces a digest anyone can recompute; HMAC additionally mixes in a secret key, so the output also proves the sender knew that key, matching webhook signature schemes.

Does this tool upload my text to compute the hash?

No, digests and HMACs are computed with the browser's built-in SubtleCrypto implementation running in the page, so the input text and any HMAC key never leave your device.

Can I verify a webhook signature with this tool?

Yes, if the provider signs the raw request body with HMAC-SHA256 or similar, paste that body as the input and the signing secret as the key, then compare the output to the signature header.

Hash & HMAC Generator

Compute SHA-1/256/384/512 digests and HMACs in your browser via Web Crypto.

Local, Runs entirely in your browser, your data never leaves your device.

Loading tool…

Compute SHA digests and HMACs locally

This tool computes cryptographic digests of text you paste in, using the browser's native Web Crypto (SubtleCrypto) implementation of SHA-1, SHA-256, SHA-384 and SHA-512. Switch on HMAC to sign the same text with a secret key instead of a plain digest, useful for checking webhook signatures or API request signing. Because SubtleCrypto runs the algorithm in the browser, neither the text nor any HMAC key you enter is sent anywhere.

How to use the Hash & HMAC Generator

Paste or type the text you want to hash into the input field.
Pick an algorithm: SHA-1, SHA-256, SHA-384 or SHA-512.
Toggle HMAC and enter a secret key to compute a keyed signature instead.
Copy the resulting hex digest for comparison or storage.

MD5 is deliberately not offered: the browser's SubtleCrypto API doesn't implement it, and it's broken enough for collision attacks that this tool doesn't add a separate JS implementation for it.

SHA-1 is included for compatibility with older systems and Git object hashes, but it's not appropriate for anything needing collision resistance today; prefer SHA-256 or SHA-512 for new work.

Frequently asked questions

Why is there no MD5 option?: The Web Crypto API this tool relies on doesn't implement MD5, and since MD5 collisions are practical to produce, it isn't worth adding a separate library just to offer a broken algorithm.
What's the difference between hashing and HMAC here?: Plain hashing takes only your text and produces a digest anyone can recompute; HMAC additionally mixes in a secret key, so the output also proves the sender knew that key, matching webhook signature schemes.
Does this tool upload my text to compute the hash?: No, digests and HMACs are computed with the browser's built-in SubtleCrypto implementation running in the page, so the input text and any HMAC key never leave your device.
Can I verify a webhook signature with this tool?: Yes, if the provider signs the raw request body with HMAC-SHA256 or similar, paste that body as the input and the signing secret as the key, then compare the output to the signature header.