Hash Generator - MD5, SHA-1, SHA-256, SHA-512 and HMAC in One Call

Hash any text or any file at a URL, with every algorithm at once, in both hex and base64. Optional HMAC (keyed) digests with the same call. Bulk-capable, no API key of your own, no upload step. $0.0005 per input. Failures are recorded free.

Checksum verification, deduplicating scraped records, signing webhook payloads, cache keys, integrity-checking a downloaded release file: all of it is "give me the digest of this", and most tools make you pick one algorithm and paste one string at a time. This one takes a list and returns the whole set.

What you get

Per input, one record with these exact fields:

• ok - true when the digest was produced
• input - the text you sent, or the URL you asked to be fetched
• type - text or url
• bytes - the exact byte length that was hashed
• finalUrl / status - only for url inputs, after redirects
• hashes - one entry per requested algorithm, each with hex and base64
• hmac - the same shape, keyed with your hmacKey, or null when no key was given
• error - present instead of the digests when a fetch failed. Never charged.

Example 1: one string, all four algorithms

Input:

{ "text": "The quick brown fox jumps over the lazy dog", "algorithms": ["md5", "sha1", "sha256", "sha512"] }

Output (real run, 2026-08-15 - these are the published test vectors for this sentence, so you can verify the actor against any reference implementation):

{
  "ok": true,
  "input": "The quick brown fox jumps over the lazy dog",
  "type": "text",
  "bytes": 43,
  "hashes": {
    "md5":    { "hex": "9e107d9d372bb6826bd81d3542a419d6", "base64": "nhB9nTcrtoJr2B01QqQZ1g==" },
    "sha1":   { "hex": "2fd4e1c67a2d28fced849ee1bb76e7391b93eb12", "base64": "L9ThxnotKPzthJ7hu3bnORuT6xI=" },
    "sha256": { "hex": "d7a8fbb307d7809469ca9abcb0082e4f8d5651e46d3cdb762d02d0bf37c9e592", "base64": "16j7swfXgJRpypq8sAguT41WUeRtPNt2LQLQvzfJ5ZI=" },
    "sha512": { "hex": "07e547d9586f6a73f73fbac0435ed76951218fb7d0c8d788a309d785436bbb642e93a252a954f23912547d1e8a3b5ed6e1bfd7097821233fa0538f3db854fee6", "base64": "B+VH2VhvanP3P7rAQ17XaVEhj7fQyNeIownXhUNru2Quk6JSqVTyORJUfR6KO17W4b/XCXghIz+gU489uFT+5g==" }
  },
  "hmac": null
}

Example 2: HMAC for webhook signing

Input:

{ "text": "The quick brown fox jumps over the lazy dog", "algorithms": ["sha256"], "hmacKey": "secret-key" }

Output (real run, same session - hashes is the plain digest, hmac is the keyed one):

{
  "ok": true,
  "bytes": 43,
  "hashes": { "sha256": { "hex": "d7a8fbb307d7809469ca9abcb0082e4f8d5651e46d3cdb762d02d0bf37c9e592", "base64": "16j7swfXgJRpypq8sAguT41WUeRtPNt2LQLQvzfJ5ZI=" } },
  "hmac":   { "sha256": { "hex": "affee3b4888c714d8369e419b5e51d1ff7c024b64a94d76b8dd53c8fb5d0a2dc", "base64": "r/7jtIiMcU2DaeQZteUdH/fAJLZKlNdrjdU8j7XQotw=" } }
}

Example 3: checksum a released file, and a mixed batch

Input (strings and URLs can be mixed in one items array; a bare https:// string is fetched):

{
  "items": [
    "https://raw.githubusercontent.com/apify/apify-sdk-js/master/package.json",
    "order-id-88213",
    { "text": "another payload" }
  ],
  "algorithms": ["sha256"]
}

Each item returns its own record. URL items add finalUrl and status; an unreachable URL comes back as {"ok": false, "error": "HTTP 404 fetching file"} and is not charged.

Pricing

$0.0005 per input hashed. No start fee. One event covers one text string or one fetched file, hashed with every algorithm you requested plus the HMAC pass - asking for four algorithms instead of one costs the same as asking for one. A failed fetch is recorded and never charged, so a broken URL in a batch of 50 costs you nothing.

Honest comparison: the closest listings on the Apify Store (rixin's sha256-hash-generator, sha512-, md5-, sha1-hash-generator, checked 2026-08-07) are one algorithm per actor and list their per-operation event unpriced behind a start fee, so a like-for-like number is not published to compare against. What is comparable is the shape of the work: four of those actors plus HMAC is four runs and four start fees; here it is one call.

When NOT to use this

• Password storage. These are fast hashes. Passwords need a deliberately slow KDF (bcrypt, scrypt, argon2). Do not store MD5 or SHA-256 of a password, keyed or not.
• Security-sensitive uniqueness with MD5 or SHA-1. Both are broken against deliberate collision attacks. They are included for checksums and legacy compatibility. Use SHA-256 or SHA-512 when an attacker could choose the input.
• Files bigger than 25 MB, or files that need auth headers to download. Fetches are plain unauthenticated GETs.
• Identifying an unknown hash. That is the inverse problem - see EliAI/hash-identifier.
• One hash, once, by hand. A local sha256sum or a browser tool is free. This earns its price on batches, in pipelines, and as an agent tool.

Honest limits

• Algorithms: MD5, SHA-1, SHA-256, SHA-512. Unrecognized names in algorithms are dropped, and if nothing valid remains, all four run.
• Up to 50 inputs per run; fetched files capped at 25 MB; 20 second fetch timeout.
• HMAC uses the same hmacKey across every requested algorithm; there is no per-algorithm key.
• Text is hashed as UTF-8 bytes. If your reference implementation hashed a different encoding, the digests will differ - bytes in the output tells you exactly how many bytes were hashed.

FAQ

How do I generate an MD5 and a SHA-256 of the same string at once? Send {"text": "...", "algorithms": ["md5", "sha256"]}. Both come back in one record, hex and base64, for one $0.0005 charge. Omit algorithms entirely and you get all four.

Can I hash a file by URL without downloading it myself? Yes. Send {"url": "https://.../release.zip"}. The file is fetched (up to 25 MB, redirects followed) and hashed in the run; you get bytes, finalUrl and status alongside the digests.

How do I verify a webhook signature (HMAC-SHA256)? Send the raw payload as text, your shared secret as hmacKey, and ["sha256"] as algorithms. Compare hmac.sha256.hex (or .base64, depending on what the provider sends) to the signature header. Compare with a constant-time equality check in your own code.

Do I get base64 as well as hex? Every digest is returned in both. Hex is the usual CLI/checksum form; base64 is what most signature headers and JSON APIs carry.

Is MD5 safe to use? For detecting accidental corruption and for cache/dedupe keys, yes, and it is the fastest option. For anything an attacker can influence, no - use SHA-256. Same for SHA-1.

What happens to a dead URL in the middle of a batch? It becomes an {"ok": false, "error": "..."} record and the run continues with the remaining items. Failed fetches are never charged.

Can an AI agent call this as a tool? Yes - it is exposed through the Apify MCP server, so an agent can hash a payload or checksum a file without you writing an integration.

Use from code or AI agents

curl -s "https://api.apify.com/v2/acts/EliAI~hash-generator/run-sync-get-dataset-items?token=$APIFY_TOKEN" \
  -X POST -H 'Content-Type: application/json' \
  -d '{"text":"hello","algorithms":["sha256"]}'

Agents: connect Apify MCP and call the EliAI/hash-generator tool.

• Capability: MD5 / SHA-1 / SHA-256 / SHA-512 plus HMAC of text or a fetched file, hex and base64
• Required input: text, url, or an items array
• Returns: one record per input; hashes and hmac are the payload
• Bounded: 50 inputs per run, 25 MB per fetched file; failures isolate per item
• Side effects: none (nothing is stored outside your run's dataset)

Related actors

• Hash Type Identifier (EliAI/hash-identifier) - the inverse: give it an unknown hash string and it reports the likely algorithm (MD5, SHA-1/256/512, bcrypt, NTLM, and more). This actor generates digests; that one identifies them.