About HashToolbox

HashToolbox.online is a small, independent set of developer utilities for hashing text and passwords: bcrypt, PBKDF2, MD5, SHA-1, SHA-256, SHA-512, SHA-3, HMAC and a password strength analyser. It exists because the everyday version of this task — "I need a bcrypt hash for a seed file" or "what does a salted SHA-256 of this look like?" — was oddly badly served by sites that send your input to a server, bury the tool under interstitials, or explain nothing about what the output means.

Everything runs in your browser

Each tool is plain JavaScript executed on your device, using well-established open-source libraries. Nothing you type is transmitted, logged or stored — open your browser's network panel while typing and you will see no requests. Load a page once and it keeps working with the network disconnected. That design is not a marketing line; it is the only honest way to offer this kind of utility.

We still say plainly on every relevant page: do not paste live production secrets into any online tool, this one included. You cannot verify a stranger's JavaScript at a glance, and good habits do not depend on trusting a claim.

Editorial standards

  • Concrete parameters, not vague advice. Where guidance exists — OWASP iteration counts, NIST SP 800-63B, published bcrypt cost recommendations — we state numbers and say what they assume.
  • Honest about weak algorithms. MD5 and SHA-1 have legitimate remaining uses, and we describe them, while being unambiguous that neither belongs anywhere near a password column.
  • No cracking services. We do not host reverse-lookup databases or "decrypt" endpoints. We explain why they cannot work against salted or random input.
  • Corrections welcome. If something here is wrong or out of date, tell us and it gets fixed.

How the site is funded

The tools are free and always will be. Hosting and maintenance are paid for by display advertising, kept out of the way of the tools themselves — no interstitials, no pop-ups, no ads inserted into an output field. The privacy policy describes exactly what advertising cookies do and how to opt out.

Get in touch

Bug reports, corrections and requests for new tools are all welcome through the contact page. The most requested additions so far — Argon2id in the browser, file checksums and a JWT inspector — are on the list.