When debugging API signatures, comparing data, or integrating an SDK, it helps to calculate a text digest independently. Xian's Tools provides:
- MD5 Calculator
- SHA Calculator: SHA1, SHA256, and SHA512.
- HmacSHA Calculator: Hmac-SHA1, Hmac-SHA256, and Hmac-SHA512.
Calculations run locally in your browser without sending the input to a server.
How to use the tools
MD5: enter text and click Encrypt to obtain a 32-character lowercase hexadecimal digest. Click To Upper Case if your integration expects uppercase text.
Digest lengths
- MD5：128 bits，由 32 个十六进制字符表示。
- SHA1：160 bits，由 40 个十六进制字符表示。
- SHA256：256 bits，由 64 个十六进制字符表示。
- SHA512：512 bits，由 128 个十六进制字符表示。
Length is a useful check when you already know the expected algorithm. Some systems call characters 9–24 of a full MD5 digest a “16-character MD5”; that is a shortened representation, not a separate algorithm.
Sites advertising “MD5 decryption” usually look up previously calculated values for common inputs. For reversible encryption, see AES Encryption and Decryption.
What is HMAC?
HMAC combines a hash function with a secret key to produce a message authentication code. It is used in:
- API signature verification, including service callbacks.
- Webhook request authentication.
- JWT HS256 signatures, which use HMAC-SHA256 internally.
During debugging, calculate the expected result and compare it with your program's output. This can help isolate differences in message construction or keys. A raw HMAC calculator does not construct an entire JWT or an API-specific signing payload for you.
Choosing an algorithm
- Non-security checksums: MD5 and SHA1 may appear in older integrations; SHA256 is a stronger general choice.
- Security-sensitive digest operations: SHA256 or SHA512, as required by the protocol.
- API message authentication: HMAC-SHA256 is a common choice.
- Password storage: use a dedicated salted password-hashing algorithm, such as bcrypt or Argon2, instead of plain MD5 or SHA.
MD5 and SHA1 have known collision weaknesses and should not be chosen for collision-sensitive security uses.
Frequently asked questions
Why does my result differ from someone else's?
Check extra spaces, line breaks, letter case, text encoding, and the HMAC key. Matching visible text is not enough if the underlying bytes differ.
Do uppercase and lowercase digests mean different values?
They represent the same hexadecimal bytes, but a signature comparison may require a particular letter case. Follow the receiving system's specification.
