Hash generator for Next.js & Supabase. All in your browser.
Generate checksums and HMACs, or hash and verify disposable bcrypt passwords with an explicit cost. UTF-8 inputs stay local — free, no sign-up.
Loading the tool…
Exact UTF-8 text, including whitespace. MD5/SHA-1 are unsuitable for passwords. bcrypt costs 4–12 and 72-byte maximum. No encryption, password recovery or auth provisioning.
How to use
- Choose a checksum, HMAC, bcrypt hash or bcrypt verification. Use disposable test values.
- Choose the algorithm or bcrypt cost. HMAC takes a test key; verification takes an existing bcrypt hash.
- Generate or verify locally, then copy or download. Clear values when finished and keep production credentials off public tools.
Reference documentation
Frequently asked questions
Is this free, and does my input leave the browser?
Free, no sign-up. Computation, copy and downloads stay in your browser. There is no upload or processing endpoint. Usage analytics include only a fixed tool name and action, never your input or result.
Can MD5 or SHA-1 store passwords?
No. MD5 and SHA-1 are unsuitable for passwords and collision-resistant security uses. SHA-256 and SHA-512 alone are also fast hashes, not password-storage schemes. Use a reviewed password hashing approach in your application.
Can I decrypt an MD5, SHA or bcrypt hash?
No. Hashing is one-way, not encryption. bcrypt verification hashes a candidate with the stored salt and cost, then compares. A match says nothing about password strength.
Which algorithms use Web Crypto?
SHA-1, SHA-256, SHA-512 and HMAC with those SHA algorithms use browser Web Crypto. MD5 uses a small RFC 1321 implementation because Web Crypto does not support it. bcrypt uses bcryptjs locally.
Why reject long bcrypt passwords and high costs?
bcrypt accepts at most 72 UTF-8 bytes; longer inputs are rejected instead of silently truncated. Browser hashing and verification support costs 4–12. Low costs are test settings, not production recommendations. Higher costs can take several seconds.
How does this relate to a Supabase seed?
Use a bcrypt result only where your reviewed seed expects bcrypt. pgcrypto's password form is extensions.crypt(test_password, extensions.gen_salt('bf', cost)); verify the extension schema and auth workflow. Do not publish real passwords or treat hashing as user provisioning.
Related tools
All free toolsBase64 encode / decode
Encode and decode Base64 text and files, create image data URIs and use URL-safe encoding. Recognize JSON and JWTs. Free, no sign-up, browser only.
Markdown editor & table generator
Edit Markdown with a live preview, create tables and start from README.md, AGENTS.md, CLAUDE.md or llms.txt templates. Free, no sign-up, browser only.
Unix timestamp converter
Convert epoch seconds, milliseconds and ISO dates in your browser. Inspect time zones and PostgreSQL timestamptz for Next.js + Supabase. Free, no sign-up.