BrowserDevTools

Hash, HMAC, AES-GCM & TOTP toolbox

Five things in one page: digests (batch, with HMAC), streaming file hashes that never load the file into memory, password and API-key generation with an entropy verdict, AES-GCM encryption with PBKDF2 and a self-describing output format, and a live TOTP. Nothing is uploaded and the keys never leave your device.

Equivalent command line

printf '%s' 'hello world' | openssl dgst -sha256

Quoted for you. For HMAC the key is pasted literally — in a real pipeline read it from the environment instead so it does not end up in the shell history.

Everything runs in this tab with Web Crypto; keys, passwords and file bytes never leave your device, and there is no share link.

Digests

#InputDigest
1hello worldb94d27b9934d3e08a52e52d7da7dabfac484efe37a5380ee9088f7ace2efcde9
22026-09-22T12:00:00Zc5d27674c0790414d40f4876c94f5f69c3755e03c2e5702f65758566d250202d
3The quick brown fox jumps over the lazy …d7a8fbb307d7809469ca9abcb0082e4f8d5651e46d3cdb762d02d0bf37c9e592

Byte-level work, without the upload theatre

Search for any single one of these — “sha256 generator”, “hmac generator”, “aes encrypt online”, “totp generator” — and you get a page per verb, each with its own single input box. They are mostly fine, and they mostly run in the browser too. What is missing is everything around the conversion: batching, the equivalent command line, an honest password-strength verdict, and a decrypt path for whatever the encrypt box produced.

So this page is the companion to the encode/decode toolbox, focused on the operations that need bytes rather than characters:

Everything is local: hashing, HMAC, PBKDF2, AES and TOTP all run in your tab through Web Crypto and the browser’s own primitives, and the secrets you type never cross the network — which is the whole point for a page whose inputs are keys and tokens. Two honest limits: this is not a password manager (a generated password is only as safe as where you put it), and it deliberately does not implement certificate parsing, argon2 or ChaCha20-Poly1305 — inventing cryptography is not a feature, so the primitives that are here come from the platform.

FAQ

Is it safe to paste a secret here?
The values are processed in your browser and never uploaded — you can confirm that in the Network panel; nothing is sent when you hash or encrypt. That said, treat anything you paste anywhere as potentially exposed: rotate a production secret after pasting it into any web page, including this one.
Why is MD5 and SHA-1 still offered?
Because they are still all over checksum files, legacy APIs and TOTP seeds. They are not collision-resistant and must not be used for signatures or password storage — the tool labels them accordingly rather than hiding them, and SHA-256 is the default.
Can I hash a huge file?
Yes, for MD5/SHA-1/SHA-256/CRC32: those are computed incrementally from 1 MB chunks, so memory use stays flat and you get progress. SHA-384 and SHA-512 go through the browser’s Web Crypto digest, which is one-shot, so those read the file into memory — the page tells you before you pick one.
What is inside the encrypted output?
A self-describing string: version, algorithm, PBKDF2 iteration count, salt, IV and the ciphertext, each base64url. That is why the decryption snippet works: it re-derives the key from the password and the salt, then decrypts. GCM authenticates the ciphertext, so a wrong password and a tampered value both fail loudly.
Does the TOTP match my authenticator app?
It is RFC 6238 (and RFC 4226 for HOTP) with automatic Base32 secrets, six/eight digits, 30/60 second periods and SHA-1/256/512 — the same parameters every authenticator uses. A short secret gets a warning, and the verify box accepts the neighbouring time windows so a code that is about to roll over still validates.