Hash Generator

No. Both MD5 and SHA-1 are cryptographically broken — practical collisions exist (two different inputs with the same digest). They remain fine as non-security checksums (accidental corruption, deduplication, cache keys) but must never be used for integrity, signatures, or anything an attacker could forge. Use SHA-256 or SHA-512 instead.

No — not on its own. MD5, SHA-1 and SHA-256 are all designed to be fast, which is exactly wrong for password storage: an attacker who steals your database can try billions of guesses per second against a fast hash. Passwords should be protected with a deliberately slow, salted, memory-hard algorithm designed for the job — bcrypt, scrypt or Argon2. These add a per-user salt and a tunable work factor so each guess is expensive. Never store passwords as raw MD5/SHA-1/SHA-256 digests.

HMAC (Hash-based Message Authentication Code, RFC 2104) combines a message with a secret key to produce a keyed digest. Unlike a plain hash, only someone who knows the key can compute or verify the HMAC, so it proves both that the message is intact and that it came from a party holding the key. HMAC-SHA256 is the construction behind HS256 JSON Web Tokens. This tool computes HMAC-SHA256 in your browser using the native Web Crypto API; supply the message and the secret key.

CRC32 (Cyclic Redundancy Check, 32-bit) is an error-detection checksum, not a cryptographic hash. It is excellent at catching accidental corruption — a flipped bit during a file transfer or storage — and is used in formats like ZIP and PNG. But it is fast and has no cryptographic strength: it is trivial to craft a different input with the same CRC32, so it offers no protection against deliberate tampering. Use it for integrity against accidents, never against attackers.

No. Hashing is one-way — you cannot recover the input from the digest — so it is used for fingerprints, checksums and verification, not for keeping data confidential. Encryption is two-way: it scrambles data so it can be recovered later with the correct key. Base64, by contrast, is neither — it is reversible encoding with no secret at all. If you need confidentiality, encrypt; if you need a tamper-evident fingerprint, hash; if you just need to move binary data through a text channel, use Base64.

No. Everything is hashed entirely in your browser: the SHA family and HMAC use the native Web Crypto API, and MD5 and CRC32 run via small client-side libraries. Your text, files and HMAC secret keys never leave your device and are not logged or stored. Because it is a client-side tool, it works offline once loaded — which is exactly what you want when hashing a sensitive file or secret.