Hash Text (Crypto)

Hash text with SHA, HMAC, hex or Base64 output, and hash comparison.

Free Online Hash & HMAC Generator

Cryptographic hashes verify data integrity, sign webhooks, and compare secrets without storing plaintext. Dokall supports SHA-1, SHA-256, SHA-384, SHA-512, and HMAC with hex or Base64 output.

Paste text, pick an algorithm, and copy the hash. Use the comparison feature to verify two hashes match - essential for debugging authentication and checksum workflows.

What is Hashing?

A hash function takes input of any size and produces a fixed-size output (the hash, digest, or checksum). The same input always produces the same hash. Even a tiny change in the input produces a completely different hash - this is called the avalanche effect.

Cryptographic hash functions have additional properties: it should be computationally infeasible to find the original input from the hash (pre-image resistance), to find two different inputs with the same hash (collision resistance), or to find a second input that matches a given input's hash (second pre-image resistance). These properties make hashing essential for security, data integrity, and authentication.

Hash Algorithms Compared

MD5 produces a 128-bit (32-character hex) hash. It is fast but broken for security purposes - collisions can be generated in seconds. Still used for non-security checksums (file integrity, cache keys) but should never be used for passwords or digital signatures.

SHA-1 produces a 160-bit (40-character hex) hash. Also broken - practical collision attacks exist since 2017. Deprecated by browsers, certificate authorities, and git (which is migrating to SHA-256). Avoid for new applications.

SHA-256 produces a 256-bit (64-character hex) hash. Part of the SHA-2 family. Currently considered secure with no known practical attacks. Used in TLS certificates, Bitcoin, digital signatures, and most security applications. The default choice for general-purpose hashing.

SHA-512 produces a 512-bit (128-character hex) hash. Also SHA-2 family. Faster than SHA-256 on 64-bit systems because it operates on 64-bit words. Provides a larger security margin. Used when maximum hash length or security margin is needed.

SHA-3 (Keccak) is a different algorithm family from SHA-2, standardized as a backup in case SHA-2 is ever broken. It is secure but slower in software than SHA-2. Used in some blockchain protocols and as an alternative when diversity of algorithms is desired.

Hashing vs Encryption

Hashing is one-way: you cannot recover the original data from a hash. Encryption is two-way: with the correct key, you can decrypt the ciphertext back to the original plaintext.

Use hashing when you need to verify data without storing or recovering the original. Password verification is the classic example - store the hash, and when the user logs in, hash their input and compare. File integrity checks are another - hash the file, share the hash, and the recipient can verify the file was not altered.

Use encryption when you need to protect data and later retrieve it. Database fields containing personal data, files in transit, and communication channels need encryption, not hashing.

A common mistake is using encryption for passwords. If the encryption key is compromised, all passwords are exposed. With proper password hashing (bcrypt, Argon2), even a complete database breach does not directly reveal passwords.

HMAC: Hash-Based Message Authentication

HMAC (Hash-based Message Authentication Code) combines a hash function with a secret key to produce an authentication code. While a plain hash verifies integrity (the data has not been altered), HMAC verifies both integrity and authenticity (the data came from someone who knows the secret key).

The HMAC algorithm works as follows: HMAC(key, message) = Hash((key XOR opad) || Hash((key XOR ipad) || message)). In practice, you just call your language's HMAC function with a key, message, and hash algorithm.

Common uses: API request signing (the server verifies that requests come from authorized clients), webhook verification (GitHub, Stripe, and Slack sign webhook payloads with HMAC-SHA256 so you can verify they are authentic), JWT signatures (HS256 is HMAC-SHA256), and cookie signing (frameworks sign session cookies to prevent tampering).

Hashing Passwords: Do It Right

Never hash passwords with SHA-256, SHA-512, or MD5. These algorithms are designed to be fast - a modern GPU can compute billions of SHA-256 hashes per second, making brute-force attacks trivial.

Use algorithms specifically designed for password hashing: bcrypt, scrypt, or Argon2id. These are intentionally slow (configurable work factor) and memory-hard (resistant to GPU acceleration). Argon2id is the current recommendation from OWASP and was the winner of the Password Hashing Competition.

Always use a unique random salt per password. The salt is combined with the password before hashing, ensuring that identical passwords produce different hashes. Without salting, an attacker can use precomputed rainbow tables to crack entire databases at once. bcrypt and Argon2 handle salting automatically.

Recommended parameters (2024): bcrypt with cost factor 12+, Argon2id with m=19456 KB, t=2, p=1, or scrypt with N=2^15, r=8, p=1. Tune these so that hashing takes 100-500ms on your server - slow enough to resist brute force, fast enough to not impact user experience.

Common Uses of Hashing

Data integrity verification: Download a file and compare its SHA-256 hash against the published hash to confirm the file was not corrupted or tampered with during transfer. Package managers (npm, pip) verify package integrity this way.

Content-based addressing: Git uses SHA-1 (migrating to SHA-256) to identify every commit, tree, and blob by its content hash. IPFS uses multihash for content addressing. Docker image layers are identified by their content digest.

Deduplication: Hash file contents and compare hashes to find duplicates without comparing entire files. Backup systems and cloud storage use this to avoid storing identical data twice.

Cache keys: Hash request parameters to generate cache keys. If the same parameters produce the same hash, the cached response is returned instead of recomputing.

Digital signatures: Hash the document first, then sign the hash with a private key. This is faster than signing the entire document and produces a fixed-size signature regardless of document size.

Frequently Asked Questions

Is hashing reversible?
No. Cryptographic hash functions are designed to be one-way. You cannot mathematically reverse a hash to recover the original input. However, for short or common inputs (like simple passwords), attackers can use precomputed tables (rainbow tables) or brute-force to find an input that produces the same hash. This is why password hashing uses salts and slow algorithms.
Why is MD5 no longer considered secure?
MD5 has known collision vulnerabilities - researchers can generate two different files with the same MD5 hash in seconds. This breaks digital signatures, certificate verification, and any security application that relies on collision resistance. MD5 is still acceptable for non-security uses like cache keys and file deduplication, but should never be used for passwords, signatures, or integrity verification in adversarial contexts.
What is the difference between hashing and encryption?
Hashing is one-way - you cannot recover the original data from a hash. It is used for verification (passwords, file integrity). Encryption is two-way - with the correct key, you can decrypt back to the original data. It is used for confidentiality (protecting data in transit and at rest). Use hashing for passwords, use encryption for data you need to read later.
What is HMAC and when should I use it?
HMAC (Hash-based Message Authentication Code) is a hash combined with a secret key. It verifies both data integrity and authenticity. Use HMAC when you need to confirm that a message came from a trusted source and was not altered - API request signing, webhook verification, JWT signatures (HS256), and cookie signing are common use cases.
What is a hash collision?
A collision occurs when two different inputs produce the same hash output. Since hash outputs are fixed-size, collisions must theoretically exist (pigeonhole principle). For a secure hash function, finding a collision should be computationally infeasible. When a practical collision attack is found (as with MD5 and SHA-1), the algorithm is considered broken for security purposes.
Which hash algorithm should I use?
For general-purpose hashing (file checksums, data integrity, cache keys): SHA-256. For password hashing: Argon2id, bcrypt, or scrypt - never SHA-256 or MD5. For HMAC: SHA-256 (HMAC-SHA256). For maximum security margin: SHA-512 or SHA-3. For non-security checksums where speed matters: xxHash or CRC32.
How do I hash passwords in my application?
Use a password-specific hashing library: bcrypt (available in most languages), Argon2id (recommended by OWASP), or scrypt. These libraries handle salting automatically. Never use raw SHA-256/SHA-512 for passwords - they are too fast to resist brute-force attacks. Example in Node.js: const hash = await bcrypt.hash(password, 12). To verify: const match = await bcrypt.compare(input, hash).
What is a salt in password hashing?
A salt is a random value added to the password before hashing. Each password gets a unique salt, stored alongside the hash. Salting ensures that identical passwords produce different hashes, preventing rainbow table attacks and making it impossible to identify users with the same password. bcrypt and Argon2 generate and include the salt automatically.

Related Tools

Password GeneratorGenerate strong random passwords instantly.JWT DebuggerDecode, encode, and verify JSON Web Tokens (JWT).Random KeygenAPI keys, JWT secrets, hex keys, UUIDs, and more - click to copy.