# Hash & HMAC Calculator

> MD5, SHA-2, SHA-3, BLAKE2, CRC32 and HMAC of text or files, with checksum compare. Computes MD5, SHA-1, SHA-224/256/384/512, SHA3-256/512, BLAKE2b-512, BLAKE2s-256 and CRC-32 of text or a file, or an HMAC with your key, in hex or Base64, and checks a published checksum against all of them. With JavaScript on, files and keys are hashed locally in your browser.

Part of usefulweb.site (https://usefulweb.site/). Results are deterministic calculations from the inputs and the listed assumptions; the API returns exactly what the web page shows.

## Use it
- Human interface: https://hashhmaccalculator.usefulweb.site/ (interactive tool at https://hashhmaccalculator.usefulweb.site/tool)
- JSON API: POST https://hashhmaccalculator.usefulweb.site/api/v1/calculate with a JSON object of inputs (schema: https://hashhmaccalculator.usefulweb.site/api/v1/tool)
- OpenAPI: https://hashhmaccalculator.usefulweb.site/openapi.json
- MCP (Streamable HTTP): https://hashhmaccalculator.usefulweb.site/mcp - tool `hash_hmac_calculator`

## Inputs
- text (textarea): Text - Hashed exactly as entered (no trailing newline is added). Leave empty when you choose a file.
- textFormat (select): Text is
- file (file): Or a file - Any file up to 100 MB. With JavaScript on it is hashed in your browser and never uploaded.
- algorithms (multiselect): Algorithms
- hmacKey (text): HMAC key (optional) - With a key, an HMAC (RFC 2104) is computed instead of a plain hash.
- hmacKeyFormat (select): Key is
- outputEncoding (select): Output
- expected (text): Expected hash to compare (optional) - Paste a published checksum (hex or Base64); it is compared with every computed value.

## Method
- The input bytes are the file as uploaded, or the text decoded as UTF-8, hex or Base64. Text is hashed exactly as entered: no newline is appended (unlike `echo` without `-n`).
- Digests come from OpenSSL via Node.js crypto (MD5, SHA-1, SHA-2, SHA-3, BLAKE2b-512, BLAKE2s-256) and zlib (CRC-32, IEEE polynomial, shown big-endian as in `crc32`/`cksum -a crc32b`).
- With a key, HMAC (RFC 2104) is computed for every selected hash; CRC-32 has no HMAC. SHA-3 HMACs use the SHA-3 rate as block size (NIST), BLAKE2 HMACs the BLAKE2 block size, as OpenSSL does.
- The comparison accepts hex (any case, optional spaces or colons) or Base64 and reports which algorithm matches.
- With JavaScript on, the browser computes everything locally: SHA-1/2 via WebCrypto, MD5, SHA-224, SHA-3, BLAKE2 and CRC-32 via small built-in JavaScript implementations. Files and keys never leave your device.

## Limits
- MD5, SHA-1 and CRC-32 must not be used where an attacker could craft collisions. To store passwords use a password hash (Argon2id, scrypt, bcrypt), not a plain hash.