Digest
Hash text or whole files with SHA-1, SHA-256, SHA-384 and SHA-512, and compute HMAC signatures.
HMAC signs the message box above, never the dropped file. The key is UTF-8 bytes, padded or pre-hashed to the block size the way RFC 2104 says — which is how a webhook signature header is built.
printf %s 'The quick brown fox jumps over the lazy dog' | shasum -a 256
SHA-1 is here because the world still runs on it — git object ids, old vendor checksums — but it is broken for collision resistance and must not authenticate anything new. MD5 is missing on purpose: WebCrypto refuses to implement it, and hand-rolling it in a page like this would be worse than not having it. A digest length is a hint and never a proof: 64 hex digits is SHA-256, and also SHA3-256, and also BLAKE2s.
Verifying a download against a published checksum, or reproducing the HMAC a webhook expects, are both jobs where uploading the input to a website is the wrong move.
Files are hashed by streaming them through the browser's SubtleCrypto — a large file is read locally and never sent. The HMAC side takes a key and a message and produces the digest in hex or base64, which is usually enough to find where a signature mismatch comes from.
What people open it for
- Checking a downloaded file against its published SHA-256
- Reproducing a webhook signature to debug a mismatch
- Hashing a string with a specific algorithm and encoding
In the terminal
tools crypto2
Every utility is also a command in the desktop's shell.