HASH
GENERATOR

HMAC (Hash-based Message Authentication Code) takes a regular hash and "signs" it with a secret key. So SHA-256("hello") is the same for everyone, but HMAC-SHA-256("hello", secret) only matches if you know the secret. Used in API request signing (Stripe, AWS, GitHub webhooks), JWTs, and message integrity. If you don't know whether you need HMAC, you probably don't.

Up to about 2 GB reliably on desktop browsers, less on mobile. Files are read in 1 MB chunks so the browser stays responsive. A 1 GB file typically takes 10-30 seconds to hash on desktop. The progress bar shows how far along you are.

"Broken" means an attacker can craft two different files with the same hash (collision attack). For verifying that an unmodified file matches the publisher's checksum on a download page, MD5 and SHA-1 are still fine - they detect random/accidental changes. They're not safe for password hashing, digital signatures, or any case where an attacker might be trying to forge a match.

No. Hashing happens entirely in your browser using the Web Crypto API and small JavaScript implementations for MD5 and CRC-32. Your text, files, and HMAC keys never leave your device. Safe to use with passwords, API keys, or any sensitive data.

Bcrypt is a slow, salted password hash - completely different from MD5/SHA which are fast checksums. Three things make it special:

1. It's intentionally slow. A SHA-256 hash takes microseconds. Bcrypt at cost 12 takes ~600ms. This is the whole point - it makes brute-forcing passwords expensive for attackers.

2. Same input = different output. Each generation uses a random salt, so hashing "password123" twice gives two different hashes. Both verify correctly. This is correct - it's not a bug.

3. The hash itself contains the salt. No need to store salt separately. The format is $2y$12$<22-char-salt><31-char-hash>.

Use bcrypt for storing user passwords. Use SHA-256 for everything else (file checksums, signatures, etc.).

Yes, fully compatible. Hashes generated here work with PHP's password_verify() and Laravel's Hash::check(). You can also paste hashes from your Laravel database into the verify field and check if a password matches.

One small detail: the JavaScript bcrypt library outputs hashes starting with $2b$ while PHP/Laravel uses $2y$. Both are interchangeable - all bcrypt verifiers (PHP, Laravel, Node, Python, Ruby) accept $2a$, $2b$, and $2y$ equally. The prefix differences are historical, not functional. So a hash generated here works in your Laravel app and vice versa, no conversion needed.

That's correct behavior - the hash of an empty string is itself a known value. MD5("") = d41d8cd98f00b204e9800998ecf8427e for example. Hashing zero bytes is mathematically valid; it just produces a fixed "empty input" fingerprint.