Hash Generator

What hashes are used for

• Checking downloads. When your hash matches the one the publisher lists, you know the file has not been altered.
• Storing passwords, where you should use bcrypt or argon2 and never MD5 or SHA-1.
• Signing API requests. Webhook signatures are normally made with HMAC: Paystack signs its webhooks with HMAC-SHA-512, and GitHub uses HMAC-SHA-256.
• Removing duplicate rows in a database by comparing content hashes.
• Building idempotency keys so an API call can be retried safely.

Picking an algorithm

For anything new, choose SHA-256. It is quick, resists collisions and is supported almost everywhere. MD5 and SHA-1 are broken as cryptography, so keep them for checksums where security is not at stake, such as older systems or quick deduplication where a collision would do no harm.

Your browser does the hashing through window.crypto.subtle, and none of your text reaches our server.