SHA & HMAC
Calculate SHA-256, SHA-384 and SHA-512 hashes or keyed HMACs for API test messages.
Output is lowercase hex. Spaces, line endings and Unicode bytes affect the result. No trimming or Unicode normalization is applied. Browsers may normalize pasted line endings; use a local file-hashing tool when exact file bytes matter. An empty message is valid. HMAC output is not a complete API Authorization header: follow the API’s exact canonical-request and signing rules. SHA is one-way, not encryption, and plain SHA is not a password-storage scheme.
General input limit: 1,000,000 characters per field; AES uses the smaller limits stated above. SHA, HMAC, AES and RSA require HTTPS or localhost and browser Web Crypto. Inputs are processed locally, not stored by these tools or placed in the URL.
These pages do not load the site’s AdSense script. Browser extensions, compromised devices or scripts injected by hosting settings are outside the tool’s control. Use synthetic test data; a public website is not a secure key vault.
Technical references: Web Crypto API, JWT (RFC 7519), Base encodings (RFC 4648).