About this tool
Testers need hashes to verify downloaded artefacts, compare files without opening them, and, most often, to check webhook signatures. This generator computes MD5 and the SHA family for text or a local file, and has an HMAC mode that signs a payload with a secret, the way GitHub, Shopify and most payment providers sign webhooks. Paste the signature header value into the compare box to see immediately whether your test payload and secret reproduce it. SHA and HMAC use the browser’s Web Crypto API. Web Crypto has no MD5, so MD5 comes from a small implementation verified against the RFC 1321 test suite. Files are read in your browser and never uploaded.
How to use it
- Choose Hash or HMAC, and whether the input is text or a file.
- Paste text (encoded as UTF-8) or pick a file.
- In HMAC mode, choose the algorithm and enter the secret as text or hex.
- Copy the result in hex or Base64, or paste an expected value to compare.
Hash & HMAC Generator FAQ
Why does my webhook signature not match?
Almost always because the body differs by a byte: it was pretty-printed, keys were reordered, or line endings changed. Sign the raw request body exactly as received, and check whether the provider signs extra data such as a timestamp prefix.
Is MD5 or SHA-1 safe to use?
Not for security. Practical collisions exist for both. They are fine for detecting accidental corruption and for testing legacy systems; use SHA-256 or stronger for anything security-related.
Why does the same text give a different hash in another tool?
Hashes work on bytes. Differences in encoding (UTF-8 vs UTF-16), a trailing newline, or Windows CRLF line endings all change the result. This tool hashes the exact UTF-8 bytes of the text box.