Hash Generator

Hash Generator builds a one-way digest of the current Text textarea or of one selected File, then shows lowercase hexadecimal in Hash output. Defaults are mode text, algorithm SHA-256, empty input, empty hash. Generate hash is required; there is no live digest while typing. The result is not encryption, not a password store, and not a signed statement about the file.

The sidebar records Mode, Algorithm, Input size (UTF-8 byte length of text via TextEncoder, or file.size), Hash length (actual output length, or HASH_LENGTHS for the selected algorithm before a run), and Generated at (local clock time after a successful run—not part of the digest).

SHA-256, SHA-384, SHA-512

crypto.subtle.digest(algorithm, buffer). Hex lengths 64, 96, 128. Default SHA-256.

SHA-1

Same SubtleCrypto path. UI label “(legacy)”. Hex length 40. Available for text and files when digest works.

MD5

blueimp-md5 on the JavaScript string. UI labels “(legacy / not secure)” and “(text only)”. Hex length 32. Not used for files.

toHex maps digest bytes to lowercase 0-9a-f; runGenerate then calls result.toLowerCase(). The tool does not emit Base64, does not prefix the algorithm name, and does not write a filename into the hash.

For SHA algorithms, hashText does new TextEncoder().encode(text) (UTF-8 bytes) then crypto.subtle.digest. For MD5, it passes the textarea string to md5(text) from blueimp-md5. The generate guard uses !input.trim(), so a field of only spaces is treated as empty (“Enter text or choose a file first.”). If the field has any non-whitespace, the digest uses the raw input, including leading or trailing spaces and the exact line breaks you typed.

Files are not encoded as text. hashFile reads the whole File with file.arrayBuffer() and passes that buffer to digestBuffer. There is no chunked/streaming hasher and no configured size cap; large files depend on browser memory. The picker does not filter MIME types. MD5 is not applied to that buffer.

The same bytes and algorithm should produce the same hex. Changing the textarea, file, mode, or algorithm clears hash, error, copied, expectedHash, and generatedAt. Compare checksum is disabled until a hash exists. After a run, pasting an expected value shows Match or Does not match using normalizeHash (trim + toLowerCase) on both sides. Starting a new Generate hash clears the expected field.

A Match only says the two hex strings are equal under that normalization. It does not prove who produced the file, that the file is free of malware, that a password is stored correctly, or that a download was authentic unless you already trust the expected value and used the same algorithm on the same bytes.

This page computes an unkeyed digest. It does not encrypt, decrypt, or “decode” a hash back to the input (the amber note is right that a digest is not reversible here). It does not implement HMAC, a salt field, PBKDF2, bcrypt, scrypt, Argon2, or any password-hashing KDF. It does not sign data or verify a signature. Compare checksum is string equality, not cryptographic verification of a publisher.

1. Click Text or File in the Input mode group. Switching to File while MD5 is selected sets the algorithm to SHA-256 and calls resetOutput.
2. Click SHA-256, SHA-384, SHA-512, SHA-1 (legacy), or MD5 (legacy / not secure) (text only). In File mode the MD5 button is disabled; handleAlgorithmChange also returns early if you try to select MD5.
3. Paste into Input text (placeholder “Paste text to generate a hash.”). Changing the textarea calls resetOutput. Whitespace-only text is treated as empty (“Enter text or choose a file first.”); if any non-whitespace remains, the digest uses the raw textarea, including surrounding spaces.
4. In File, click Upload a file (“Generate a checksum without uploading the file.” / “Click or drag and drop”). The hidden file input has no accept filter. A selected file shows File name, File size, and File type (or “Unknown”). Load example is Text UI only.
5. Click Generate hash. It stays disabled while Input text is whitespace-only or no file is selected. The label becomes Generating... while isGenerating is true. A new run clears expectedHash before hashing.
6. Read Hash output. Copy hash uses navigator.clipboard.writeText on the lowercase hex string. Failure clears Copied with no red error. The button stays disabled while Hash output is empty. There is no checksum-file download.
7. After a hash exists, paste into Paste expected hash under Compare checksum (disabled until then). Match or Does not match uses normalizeHash (trim + toLowerCase) on both sides.
8. Click Load example to set input to “DevToolKit”, force Text mode, clear the file, and resetOutput. It does not change the algorithm and does not run the hasher.
9. Click Clear to empty text/file, set SHA-256, and resetOutput. It does not force mode back to Text. File mode’s Clear sits under Hash output. Text Clear is disabled while input and hash are both empty; File Clear is disabled while no file is selected and hash is empty.

The buttons themselves mark SHA-1 as “(legacy)” and MD5 as “(legacy / not secure)” plus “(text only)”. Those labels are compatibility warnings in this UI, not a full security evaluation of SHA-2 either. Do not treat MD5 or SHA-1 output from this page as a modern password hash or as protection for untrusted integrity decisions. Prefer SHA-256, SHA-384, or SHA-512 when the receiving workflow allows it—and still treat the result as a digest, not as authentication.

• No HMAC, salt, keyed hash, or password KDF.
• No encryption, signing, or signature verification.
• No malware scanner, authorship check, or complete “file integrity product” beyond hashing the bytes it can read and optionally comparing hex strings.
• No streaming hasher; the selected file is read in full.
• No configured file-size or text-length cap.
• No upload of the file to a hashing API in this component (file.arrayBuffer in the page). That is not a confidentiality guarantee for the rest of the site.

A matching plain-text digest alone does not establish authorship, trust, malware safety, safe password storage, secure transmission, or complete file integrity.

HashGenerator.jsx uses blueimp-md5 and crypto.subtle.digest in the browser. It does not call trackToolEvent and does not POST the text or file to a hash endpoint. The drop zone copy (“Generate a checksum without uploading the file”) refers to that local ArrayBuffer path. The rest of the page can still load site assets and advertising; the privacy policy describes first-party analytics for event metadata (not designed to store tool contents); clipboard, extensions, and shared devices remain outside this file.

Do not paste production secrets or customer files you would not put on a shared screen. A digest does not encrypt them, and the original input is still in the page until you Clear.

• Confirm Text vs File and the algorithm before copying.
• If SHA fails, check HTTPS / SubtleCrypto; MD5 text can still run.
• If the hex differs from another tool, compare exact bytes (spaces, line breaks, UTF-8) and algorithm, not just the visible string.
• If you switched to File, remember MD5 was not used; the page may have moved you to SHA-256.
• Treat Match as hex equality after trim/lowercase, not as a trusted publisher check.
• Keep the original file or text; this page does not download a checksum file.

• Text Diff Checker — to compare two checksum lists or hash strings line by line. Compare checksum here only tests one expected value against the current digest.
• Base64 Encoder/Decoder — when you need btoa/atob of text. This page’s hex digest is not Base64, and encoding the hex characters is not the same as Base64 of the raw digest bytes.
• Password Generator — when you need a random password. This hasher is not a password-storage or password-manager tool.
• URL Encoder/Decoder — when you need percent-encoding, not a digest.