How to hash text here

Six digests and the same six again with a key: MD5, SHA-1, SHA-224, SHA-256, SHA-384 and SHA-512, each also available as HMAC. Every value was checked against an independent implementation — 36 digests per language, 12 algorithms over three inputs, matching to the last hex character.

The result is lowercase hexadecimal and nothing else: 32 characters for MD5, 40 for SHA-1, 56 for SHA-224, 64 for SHA-256, 96 for SHA-384 and 128 for SHA-512. Hashing runs in the page, so the text never leaves the browser and the tool works offline once loaded.

Paste or type the text into the box. It is hashed as UTF-8 exactly as written: spaces and line breaks count, and a trailing newline gives a different digest.
Press one of the six green buttons for a plain digest. The result appears below as a bare hex string, with no algorithm name and no separators.
Press a blue HMAC button instead and a key field appears above the buttons. Type the key and then press the same button again — the digest is recalculated only when a button is pressed.
Copy Result puts the hex string on the clipboard and Clear empties the box together with the result.

Algorithms, output and the key field

What each algorithm produces

MD5 and SHA-1 are here for checksums and for systems that still ask for them; SHA-256 and SHA-512 are the ones to reach for when the digest is going somewhere new. SHA-224 and SHA-384 are the truncated variants of those two and are included because some libraries and certificate tooling name them explicitly.

All twelve are one-way — the page has no reversing function — and the digest of a single character is as long as the digest of a megabyte. The text "abc" gives 900150983cd24fb0d6963f7d28e17f72 under MD5 and ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad under SHA-256, which is what an independent implementation returns for the same three bytes.

The key field and HMAC

HMAC mixes a secret key into the hash, so the same text yields a different digest for every key. The field is hidden until an HMAC button is pressed and hidden again as soon as a green button is pressed: a plain digest never uses the key, whatever sits in that field.

Keys longer than the hash block size are hashed first, as RFC 2104 requires, and an empty key is accepted — the page returns the digest of the text under an empty key instead of refusing. SHA-224 and SHA-384 truncate their output, which is where JavaScript HMAC helpers tend to go wrong; both were checked against an independent implementation here and match it.

What the output is, and what it is not

The result box holds the plain hex string: no prefix, no separator, no algorithm label and no added newline. That drops straight into a checksum file or a command line, and it also means pairing the digest with a filename is a manual step.

This is a hash calculator, not a password storage scheme. It applies the chosen function once, with no salt and no iteration count, and nothing here stores or compares values. For passwords use a dedicated function such as bcrypt, scrypt or Argon2 rather than a bare SHA-256 digest.

Where it runs, and one limit

The libraries come from the site, the hashing happens in the page: after loading, hashing produced no request at all, and the text is never uploaded. A 4.8 MB input was hashed with SHA-256 in about 0.6 seconds, a 1 MB input in about 0.2 seconds.

The input is a text box, so the tool hashes text as UTF-8 and binary files are out of scope — their bytes would have to be encoded first. For files and archives, compare the digest your operating system produces with sha256sum or certutil, which read bytes directly.