Hash & HMAC Generator
Generate cryptographic hashes (SHA-1, SHA-256, SHA-512) and HMAC signatures for your text data.
Use it to verify that a download matches a published checksum, to check a webhook or API signature against an HMAC you compute from a shared secret, or to compare how each algorithm transforms the same input.
All hashing runs locally in your browser, so the text and secret you enter are never sent to a server.
Configuration
Hash and HMAC Generator
Hash functions and HMAC signatures are used to verify integrity, compare data, sign webhook payloads, and debug authentication flows. This tool helps generate common SHA hashes and HMAC values in the browser from text input.
Common use cases
- Verify file or payload integrity: Compare expected and actual hash values during debugging.
- Debug webhook signatures: Recreate HMAC values from a payload and shared secret.
- Generate test fixtures: Prepare sample hashes for documentation, tests, or API examples.
Security note
Plain hashes are not suitable for storing passwords without a dedicated password hashing algorithm and salt. HMAC secrets and production payloads should be handled carefully and should not be shared in public examples.
Articles for this tool
JWT Security Deep Dive: Attack Vectors, JWKS, and Production Best Practices
A thorough guide to JWT security — covering the alg:none attack, algorithm confusion, key management with JWKS, token revocation strategies, and a production-ready security checklist.
Hashing, Salt, and HMAC: A Developer's Guide to Secure Data Handling
Learn how SHA-256, bcrypt, and Argon2 work, why salting passwords is non-negotiable, when to use HMAC vs. plain hashing, and practical implementation patterns in JavaScript, Python, and Go.
Encoding vs Hashing vs Encryption: The Difference and When to Use Each
Base64 encoding, SHA-256 hashing and encryption are constantly confused, yet serve completely different purposes. A comparison table, concrete examples, and the right choice for each use case.
Recent Articles
curl Options Cheat Sheet: What -X, -H and -d Actually Do
A reference for the curl options you meet in real API work: why -d already implies POST, how -d differs from --data-raw, the @ prefix that silently reads a file, single vs double quotes, and why -k and -L deserve more caution than they usually get.
Converting Between JSON Schema and Zod: How required Maps to .optional()
Inside a two-way converter that turns JSON Schema into a Zod schema and Zod code back into JSON Schema. Covers the inverted defaults between required and .optional(), the constraint mapping table, and how the Zod side is parsed without executing any code.
SQL Clause Order Reference: Why WHERE Can't See Your SELECT Alias
The order you write SQL clauses is not the order the database runs them. A reference for the logical execution order (FROM → WHERE → GROUP BY → HAVING → SELECT → ORDER BY → LIMIT), why aliases fail in WHERE, when to use WHERE vs HAVING, and the MySQL/PostgreSQL differences that bite.
Unified Diff Format Reference: Reading @@ Hunks in git diff Output
How to read the unified diff format git produces: what the four numbers in @@ -12,7 +12,9 @@ mean, why a one-character edit shows as a whole-line replacement, the whitespace and line-ending traps, \ No newline at end of file, combined @@@ diffs on merges, and rename detection via similarity index.
UTC to JST Reference: The 9-Hour Offset, Cheat Sheet & Timezone Pitfalls
Convert between UTC and JST (Japan Standard Time) with a cheat sheet. Covers what Z and +09:00 mean in ISO 8601, when JavaScript date parsing silently shifts by 9 hours, MySQL/PostgreSQL timezone behavior, and why GitHub Actions cron always runs in UTC.
CREATE TABLE Reference: MySQL vs PostgreSQL vs SQLite Types & Constraints
A cross-database CREATE TABLE (DDL) reference with cheat sheets for data types, auto-increment keys (AUTO_INCREMENT / IDENTITY / rowid), foreign key ON DELETE behavior, and the CHECK constraint that MySQL silently ignores.