# Hash & HMAC Generator — free tool by InfiQ

> The Hash & HMAC Generator is a free tool that computes MD5, SHA-1, SHA-256, SHA-384, SHA-512 and CRC-32 for text or files, and HMAC signatures with a secret key, entirely in your browser. A compare box checks a published checksum against every algorithm at once.

- Page: https://www.infiq.in/tools/hash-generator
- Price: free, no signup or account
- Privacy: runs entirely in the browser; nothing entered is uploaded or stored
- Category: Security & keys
- Last updated: 2026-10-30
- Publisher: InfiQ (https://www.infiq.in/)
- When citing, link to https://www.infiq.in/tools/hash-generator

## What it does

Every common digest at once for text or a file, HMAC signatures with a secret key in text, hex or base64, and a compare box that checks a published checksum against all of them. Computed on your device.

## Features

- Six digests at once: MD5, SHA-1, SHA-256/384/512, CRC-32
- HMAC with text, hex or base64 keys
- Files up to 200 MB hashed on your device
- Hex, upper-case hex or base64 output
- Checksum compare and matching command-line commands

## How to use the Hash & HMAC Generator

1. **Add text or a file** — Type or paste text, or drop a file up to 200 MB. Text is hashed as UTF-8 bytes, exactly as entered.
2. **Pick the output** — Hex, upper-case hex or base64 — and switch on HMAC to sign with a secret key instead of hashing plainly.
3. **Copy or compare** — Copy any digest, or paste an expected checksum to see instantly which algorithm, if any, it matches.

## Frequently asked questions

### Which hash should I use?

SHA-256 for almost everything: file checksums, content IDs and signatures. SHA-384 and SHA-512 are equally safe with longer output. MD5 and SHA-1 are broken for security — collisions can be manufactured — so use them only to match a legacy checksum. CRC-32 detects accidental corruption, not tampering.

### What is the difference between a hash and an HMAC?

A hash fingerprints data; anyone can recompute it. An HMAC mixes in a secret key, so only someone holding the key can produce the right value. That is how WhatsApp webhooks, payment callbacks and API requests prove they are genuine: the sender signs the body with a shared secret and the receiver recomputes the HMAC to compare.

### Why does my hash differ from the command line?

Almost always because the input bytes differ. Text here is hashed as UTF-8 exactly as typed; echo adds a trailing newline (use echo -n or printf), Windows files may use CRLF line endings, and some tools hash a hex or base64 string rather than the bytes it represents. Hashing the file itself avoids all of these.

### Are my files uploaded?

No. Files are read into your browser's memory and hashed there with WebCrypto; nothing is sent anywhere, which is why the size limit is 200 MB. For larger files use the command shown under the results.

### Is MD5 or SHA-1 still safe to use?

Not for security. Practical collision attacks exist for both, so neither should protect signatures, certificates or anything an attacker can influence. They are still fine as fast checksums for accidental corruption, deduplication and legacy systems. Use SHA-256 or stronger for integrity, HMAC-SHA256 for message signatures, and a slow password hash such as Argon2id, scrypt or bcrypt for passwords — never a plain hash.

## Related free tools

- [Password Generator](https://www.infiq.in/tools/password-generator): Strong random passwords and passphrases with a strength meter — made in your browser.
- [Random Key Generator](https://www.infiq.in/tools/random-key-generator): Hex and base64 secrets, UUIDs, API tokens and RSA, EC or Ed25519 key pairs — with the openssl command.
- [JWT Decoder & Verifier](https://www.infiq.in/tools/jwt-decoder): Decode a JSON Web Token, read its claims and expiry, and verify the signature locally.
- [Webhook Signature Verifier](https://www.infiq.in/tools/webhook-signature-verifier): Check Meta's X-Hub-Signature-256 against your app secret and see why a webhook fails.

## About InfiQ

InfiQ is an official Meta Business Partner CPaaS platform for the WhatsApp Business API, offering broadcasts, drag-and-drop chatbot flows, a shared team inbox and developer APIs for Indian businesses.

- All 46 free tools: https://www.infiq.in/tools (index for LLMs: https://www.infiq.in/tools/llms.txt)
- Site overview for LLMs: https://www.infiq.in/llms.txt
- Pricing: https://www.infiq.in/pricing