crypto/toolkit
TR

SHA-256 · SHA-512 · HMAC

Hash and HMAC

Compute the SHA-256 and SHA-512 hashes of text or a file, check whether a download matches its published hash, or produce an HMAC with a secret key.

Operation
Source

Input

File

Case, spaces and colons do not matter; SHA-256 or SHA-512 is detected from the length.

Output

The result will appear here. Nothing is sent to the server.
How it works
  1. A hash function turns data of any size into a fixed-size fingerprint: 32 bytes for SHA-256, 64 bytes for SHA-512. The same data always gives the same hash.
  2. Changing even a single bit gives a completely different hash (the avalanche effect). The data cannot be recovered from the hash, and finding two inputs with the same hash is practically impossible. That is why hashes are used to check that downloads are intact.
  3. HMAC mixes a secret key into the hash. Without the key nobody can change the data and produce a valid HMAC, so it is used to verify API requests and webhooks. Simply hashing "key + data" is not safe; HMAC's construction closes that weakness.
  4. The comparison runs in constant time: it does not stop at the first different character, so the time taken does not reveal how much of the value was right.

SHA-256 is not suitable for storing passwords: it is so fast that it does not slow down guessing. Passwords need slow functions such as PBKDF2, bcrypt or Argon2 (the Password encryption tool uses PBKDF2).