Delimiter.live
7 tools

Hash Tools

Hash tools turn any input into a fixed-length digest. Use SHA-256 or SHA-512 for integrity checks and signatures, HMAC when a shared secret must authenticate a message, and bcrypt for storing passwords. MD5 and SHA-1 are provided for compatibility with older systems only — both are broken for collision resistance and unsuitable for security.

A hash function maps input of any size to a fixed-length value. The useful properties are that the same input always produces the same digest, a tiny change produces a completely different one, and the original cannot be recovered from the result.

Which function to reach for depends entirely on the job. Checksums and signatures want SHA-256. Authenticating a webhook wants HMAC, because a plain hash of a secret plus a message is vulnerable to length-extension. Storing passwords wants bcrypt or another deliberately slow function, because general-purpose hashes are far too fast to resist offline cracking.

Modern digests

3 tools

The SHA-2 family, suitable for integrity checking and signatures.

Legacy digests

2 tools

Broken for security, still needed for compatibility with older systems.

Keyed and password hashing

2 tools

Authenticating messages with a shared secret, and storing passwords safely.

What people use these for

  • Verify a downloaded file matches the SHA-256 checksum its publisher published.
  • Reproduce an HMAC signature to debug why a webhook is being rejected.
  • Generate a bcrypt hash to seed a test user in a development database.
  • Confirm an existing bcrypt hash matches a known password during a migration.
  • Produce an MD5 digest for a legacy system that accepts nothing else.
  • Compare two digests to confirm two files are byte-for-byte identical.

Hash Tools: frequently asked questions

Is it safe to hash a real secret in a web page?
MD5, SHA and HMAC generation here uses the browser Web Crypto API and transmits nothing. Bcrypt is the exception: it runs on our server, so the value you type is sent to Delimiter.live to be hashed. As a general habit, prefer test values over live production secrets in any web tool.
Can a hash be reversed?
Not by computation. Hashes are one-way. Short or common inputs can still be recovered by looking the digest up in a precomputed table, which is exactly why password storage needs a salted, deliberately slow function such as bcrypt rather than a bare SHA-256.
Should I still use MD5?
Not for anything security-related. Practical collisions have been demonstrated, so MD5 cannot prove a file has not been tampered with. It remains acceptable only as a non-security checksum or when a legacy system leaves you no choice. SHA-1 is in the same position.
Why use HMAC instead of hashing the secret and message together?
Because SHA-256(secret + message) is vulnerable to a length-extension attack: an attacker who knows the digest and the message length can append data and compute a valid digest without knowing the secret. HMAC uses a nested construction that closes this hole.
Why does bcrypt produce a different hash every time?
Bcrypt generates a random salt for each hash and stores it inside the output string. Two hashes of the same password therefore look completely different, which is the point — it defeats precomputed tables. Verification reads the salt back out of the stored hash.
All tools →

Last reviewed 7 August 2026.