Is my data or file uploaded to any remote server?

No. All calculations are executed 100% locally in your web browser memory using the W3C Web Cryptography API (crypto.subtle) and pure client-side JavaScript. Your text strings, files, passwords, and secret keys never touch any external server.

Can I verify the checksum of a downloaded file or ISO image?

Yes! Switch to the "File Checksum Studio" tab, select your file, and paste the vendor-provided hash into the "Checksum Verifier" field. Toolique will instantly tell you whether the checksum matches and which algorithm was used.

What is HMAC and when should I use it?

HMAC (Hash-based Message Authentication Code) combines a cryptographic hash algorithm with a secret shared key. It is commonly used in REST APIs (such as AWS Signature v4, Stripe webhooks, and GitHub Webhook secrets) to guarantee both data integrity and authentication.

Why are MD5 and SHA-1 labeled as legacy or integrity only?

Due to mathematical advances, theoretical collision attacks have been demonstrated against MD5 and SHA-1. They remain safe and standard for detecting accidental file corruption and deduplication, but should never be used for password hashing or high-security digital signatures. For modern security, use SHA-256 or SHA-512.

What is Subresource Integrity (SRI) Base64 format?

Web browsers allow loading scripts with an integrity attribute like `integrity="sha256-..."`. By toggling the format to Base64, you can copy the exact base64-encoded hash needed for HTML script and stylesheet tags.

Hash Generator | Toolique

Hash Generator

Calculate MD5, SHA-1, SHA-256, SHA-384, SHA-512, and CRC-32 hashes in real-time. Features file checksum hashing, HMAC secret keys, Base64 SRI encoding, and instant checksum verification.

⚡ Interactive Calculation Engine Active

Please enable JavaScript in your browser to run live computations, 2D envelope diagrams, and export PDF reports.

How to Use Hash Generator

Type or paste your text string, or switch to "File Checksum Studio" and drag-and-drop any file (up to 200MB).
View calculated MD5, SHA-1, SHA-256, SHA-384, SHA-512, and CRC-32 checksums updated live in real time.
Enable "HMAC Mode" if you need keyed-hash message authentication (RFC 2104) with a shared secret key.
Toggle between Lowercase, Uppercase, or Base64 (SRI) output formatting.
Paste a vendor or release checksum into the "Checksum Verifier" box to verify file integrity with 1-click confirmation.
Copy individual hashes, click "Copy All Hashes", or download an official formatted checksums.txt file.

Cryptographic Hash Functions vs Checksums

Cryptographic hash functions (like SHA-256, SHA-512, and SHA-384) are one-way mathematical algorithms designed to be irreversible and collision-resistant. A single bit change in the input produces a completely unpredictable and radically different output (the avalanche effect). CRC-32 is a non-cryptographic cyclic redundancy check designed specifically for high-speed transmission and zip storage error detection.

RFC 2104 HMAC Authentication

Keyed-Hash Message Authentication Code (HMAC) allows two parties sharing a secret key to authenticate messages. Toolique supports HMAC computation for SHA-256, SHA-512, SHA-384, SHA-1, and MD5, matching standard Node.js `crypto.createHmac` and OpenSSL output.

Frequently Asked Questions

Is my data or file uploaded to any remote server?: No. All calculations are executed 100% locally in your web browser memory using the W3C Web Cryptography API (crypto.subtle) and pure client-side JavaScript. Your text strings, files, passwords, and secret keys never touch any external server.
Can I verify the checksum of a downloaded file or ISO image?: Yes! Switch to the "File Checksum Studio" tab, select your file, and paste the vendor-provided hash into the "Checksum Verifier" field. Toolique will instantly tell you whether the checksum matches and which algorithm was used.
What is HMAC and when should I use it?: HMAC (Hash-based Message Authentication Code) combines a cryptographic hash algorithm with a secret shared key. It is commonly used in REST APIs (such as AWS Signature v4, Stripe webhooks, and GitHub Webhook secrets) to guarantee both data integrity and authentication.
Why are MD5 and SHA-1 labeled as legacy or integrity only?: Due to mathematical advances, theoretical collision attacks have been demonstrated against MD5 and SHA-1. They remain safe and standard for detecting accidental file corruption and deduplication, but should never be used for password hashing or high-security digital signatures. For modern security, use SHA-256 or SHA-512.
What is Subresource Integrity (SRI) Base64 format?: Web browsers allow loading scripts with an integrity attribute like `integrity="sha256-..."`. By toggling the format to Base64, you can copy the exact base64-encoded hash needed for HTML script and stylesheet tags.