Hash Generator

All four are cryptographic hash functions that produce a fixed-length fingerprint from any input, but they differ in security and output size. MD5 (128-bit) and SHA-1 (160-bit) are considered broken — collision attacks have been demonstrated and they should not be used for security purposes. SHA-256 (256-bit) is the current internet standard, used in TLS, JWT signing, and most password hashing schemes. SHA-512 (512-bit) provides extra security margin for high-value targets such as financial APIs and government systems. For file integrity verification where collision resistance is not critical, MD5 and SHA-1 are still widely used in legacy tools.

Yes — this is called a collision. Every hash function can theoretically produce identical output for different inputs, because the output is shorter than the input. However, a good hash function makes it computationally infeasible to find such a collision deliberately. MD5 and SHA-1 are broken precisely because researchers found efficient ways to engineer collisions. SHA-256 and SHA-512 have no known practical collision attacks. This matters for security: if an attacker can craft a different file with the same MD5 checksum as a trusted file, they can substitute it undetected.

No — neither MD5 nor SHA-256 (or SHA-512) alone is safe for password storage. Raw hash functions are designed to be fast, which is exactly what attackers exploit: modern GPUs can compute billions of MD5 hashes per second, making brute-force attacks trivial. For passwords you must use a purpose-built, deliberately slow algorithm: bcrypt, scrypt, Argon2id, or PBKDF2. These add a unique salt per user and a configurable work factor that keeps verification slow even as hardware improves. Use this tool for checksums and API signing — not for storing user passwords.

HMAC (Hash-based Message Authentication Code) combines a hash function with a secret key to produce an authentication tag. Where a plain hash verifies data integrity (it has not changed), HMAC also verifies authenticity (it came from someone who holds the secret key). HMAC-SHA-256 is the standard for API request signing — used by AWS Signature v4, Razorpay, PayU, Stripe, Shopify and virtually every payment gateway. To compute HMAC you need a key, so this tool (which performs keyless hashing) cannot generate HMAC tags — but you can use it to verify the SHA-256 of a payload before passing it to your HMAC library.