Hash Generator, HMAC & AES Encryption

How to use

Choose Hash, HMAC, Encrypt / Decrypt, Key pairs or bcrypt at the top.
Hash: type text and the selected digests appear instantly. Switch “Interpret input as” to hash hex or Base64 bytes directly.
HMAC: enter the message and key, then paste a received signature into “Compare with” to see whether it matches.
Encrypt: enter a password and plaintext, press “Encrypt” and keep the Base64 output. To decrypt, paste it back with the same password.
Key pairs and bcrypt: pick the type or cost, press the button, then copy or save the result.

What it does

12 hashes in one pass

MD5, SHA-1, SHA-224/256/384/512, SHA3-256/512, BLAKE2b, BLAKE3, CRC32 and xxHash64, output as hex (either case) or Base64. Paste an expected value and the matching row is highlighted.

Reproduce encoding differences

Hash text as UTF-8 or UTF-16LE, or hash raw bytes given as hex or Base64 — the quickest way to find out why another tool gives a different digest.

Self-describing ciphertext

Keys are derived with PBKDF2-SHA256 (600,000 iterations) or Argon2id (64 MiB), then AES-256-GCM encrypts the text. The output embeds the format version, KDF settings, salt and IV, all covered by the authentication tag.

Errors that say what went wrong

Wrong password or tampering, truncated copies and foreign formats are reported separately. Abusive KDF settings in a crafted ciphertext are refused before any work starts, so it cannot freeze your device.

Key pairs as PEM and JWK

Generate RSA-OAEP / RSA-PSS (2048, 3072, 4096-bit), ECDSA (P-256, P-384) or Ed25519 keys and export SPKI / PKCS#8 PEM and JWK, with a SHA-256 fingerprint of the public key.

bcrypt create & verify

Create bcrypt hashes with cost 4–15 and verify against $2a$ / $2b$ / $2y$ hashes, with a warning when a password exceeds bcrypt’s 72-byte limit.

Use cases

Check a downloaded token’s or text’s SHA-256 against a published value
Verify a webhook signature (HMAC-SHA256 from Stripe, GitHub …) by hand before writing code
Encrypt a short note or config value with a password for storage or hand-off
Create ECDSA or RSA key pairs as PEM / JWK for JWT signing tests
Find out whether a password matches a bcrypt hash from your database

Supported formats

Hashes

MD5SHA-1SHA-224 / 256 / 384 / 512SHA3-256 / 512BLAKE2b-512BLAKE3-256CRC32xxHash64

Input

UTF-8UTF-16LEHexBase64 / Base64URL

Key output

PEM (SPKI public / PKCS#8 private)JWK

Capability matrix

Feature	Support	Notes
Text hashing (12 algorithms)	Supported	Up to 10 MB
HMAC (SHA-256 / 384 / 512 / SHA-1) compute & compare	Supported	—
Password-based AES-256-GCM encryption	Supported	PBKDF2 or Argon2id
Key pair generation (RSA / ECDSA / Ed25519)	Partial	Ed25519 where the browser supports it; no OpenSSH format or CSR
bcrypt create & verify	Supported	Cost 4–15
Recover text from a hash (“hash decryption”)	Not supported	Hashes are one-way; recovery is impossible
Decrypt ciphertext from OpenSSL or other tools	Not supported	Only this tool’s own format (LWE v1)
Hashing files	Not supported	Use the File Hash tool

Limits & notes

Hash and HMAC input up to 10 MB.
Encryption works on text only, and decryption only on this tool’s format (Base64 starting with LWE).
Argon2id uses 64 MiB of memory and may be slow or fail on older phones; use PBKDF2 there.
bcrypt cost 4–15 when creating and up to 17 when verifying (higher would take too long).
Generated private keys are shown unencrypted — handle them with care.

Privacy & safety

Text, keys, passwords and generated private keys are processed only inside your browser. Nothing is uploaded, stored in the browser or recorded in analytics. Cryptography uses the browser’s Web Crypto API and hash-wasm, which ships with the page.

FAQ

Can a hash be decrypted back to the original text?

No. Hash functions are one-way; there is no way to compute the input from the digest. Sites that claim to “decrypt” hashes only look up precomputed tables of common strings. This tool deliberately offers no such feature.

Should I stop using MD5 and SHA-1?

Do not use them where security matters, such as tamper detection or signatures — practical collision attacks exist. They are still used for accidental-corruption checks and legacy compatibility.

Why does another site give a different hash?

Usually the text encoding (UTF-8 vs Shift_JIS), line endings (LF vs CRLF) or a trailing newline differ. Switch the input interpretation here, or enter the exact bytes as hex, to pin it down.

How do I decrypt text I encrypted here?

Open Encrypt / Decrypt, choose Decrypt, paste the ciphertext and enter the same password. The KDF settings are stored in the ciphertext, so you do not need to remember which one you used.

Should I store passwords with SHA-256 or bcrypt?

Use a deliberately slow scheme such as bcrypt or Argon2id. SHA-256 is so fast that leaked hashes can be brute-forced on GPUs at enormous speed.

Password Studio — Generator & Strength Checker

A strong 20-character password is ready when the page opens. Fine-tune symbols and excluded characters, switch to a memorable passphrase, or check a password you already use — all without sending anything off your device.

No upload

Secret Scanner

Paste text or drop config and code files to list likely secrets with file, line and rule before you publish or share them. Values are masked by default and you can save a copy with them replaced by ***. A helper only — it cannot guarantee that nothing is missed.