TASK

Use HTTP Digest Authentication

Digest Auth hashes credentials with a server nonce, preventing password exposure without HTTPS. Learn the challenge-response flow and MD5 usage.

1

Digest Auth sends a challenge (nonce, realm) from the server. The client computes MD5(username:realm:password) and MD5(method:uri) and sends MD5(ha1:nonce:ha2). The server verifies by recomputing. The password is never sent in clear text, but MD5 is weak — Digest Auth is obsolete; use HTTPS + Bearer tokens instead.
2

HMAC Generator →
Generate an HMAC for the digest computation. While Digest Auth uses MD5 (not HMAC), the concept is similar: a keyed hash of the message. HMAC is more secure — use it for modern authentication schemes.
3

Hash Calculator →
Compute the MD5 hash for Digest Auth components: HA1 = MD5(username:realm:password), HA2 = MD5(method:uri), response = MD5(HA1:nonce:HA2). Note: MD5 is cryptographically broken — use only for legacy Digest Auth compatibility, not for new systems.

Frequently asked questions

Is Digest Auth secure?: It is better than Basic Auth over HTTP (password is not sent in clear text), but it relies on MD5 which is broken. It does not protect against man-in-the-middle (MITM) attacks or provide confidentiality. Use HTTPS + Bearer tokens for modern authentication. Digest Auth is retained for legacy compatibility only.
Why is Digest Auth obsolete?: It requires storing HA1 (MD5 of password) on the server, which is vulnerable to rainbow table attacks. It does not support modern password hashing (bcrypt, scrypt). It is complex to implement correctly (nonce management, qop, opaque). HTTPS makes the password protection of Digest Auth redundant.

Workflows that solve this

Hash content and encode as Base64

Compute a hash of the input and encode the hash digest as Base64 for compact transport.

Hash text and verify integrity

Compute a hash of the input text and compare it against an expected hash to verify integrity.

Hash text and verify with CRC32 checksum

Compute both a cryptographic SHA-256 hash and a CRC32 checksum for data integrity verification.

HMAC Sign then Base64 Encode

Generate HMAC signature then Base64-encode for API auth headers.

HMAC sign and verify

Generate an HMAC signature for a message and verify it against an expected signature.

HMAC-sign an API request string

Generate an HMAC-SHA256 signature for a request payload to authenticate API calls.

MD5 Hash then Base58 Encode

Compute MD5 hash then encode as Base58 for compact representation.

Multi-hash speed comparison

Hash the input and benchmark multiple hash algorithms to compare their speed and output.

Generate Password and Hash

Generate a random password then hash it for secure storage.

SHA3-256 Hash with CRC32 Checksum

Compute SHA3-256 hash then CRC32 checksum for dual integrity verification.

SHA-512 Hash then Hex Encode

Compute SHA-512 hash then encode as hex for readability.

Reverse Text and Hash

Reverse text then compute SHA-256 hash of the reversed result.

Scramble Text and Hash

Scramble text then hash the scrambled result.

Learn more

Want to understand why?

Choosing a hash algorithm: digests, password hashing, and MACs are three different jobs

A field guide to SHA-2, SHA-3, BLAKE2, MD5, bcrypt/Argon2, and HMAC — which one fits integrity checks, password storage, and message authentication, and why they are not interchangeable.

How to Chain Encoding and Hashing Workflows

Real data-processing tasks rarely use a single tool. This tutorial shows how to compose encoding and hashing tools into multi-step pipelines: a base64-to-hash-to-hex verification chain, parallel multi-algorithm integrity checking, and an automatic encoding-format conversion chain. Each pattern maps to an existing workflow recipe (base64-encode-decode-verify, hmac-sign-verify) and explains when to use inline tool chaining versus a saved recipe.

BLAKE3 Keyed Mode

The BLAKE3 keyed mode is BLAKE3's MAC mode: a 32-byte key is injected into the initial state to produce a keyed message authentication code.

A hash chain is a sequence obtained by repeatedly hashing the same value, h^0=x, h^i=H(h^{i-1}), used for one-time passwords and lightweight authentication.

Related tools

Generate HMAC (Keyed-Hash Message Authentication Code) with SHA-1/256/512. Free, private, and 100% client-side.

Hash Calculator

Compute MD5, SHA-1, SHA-256, or SHA-512 hashes with hex or Base64 output. Free, private, and 100% client-side.

Md2 Hash — pure client-side tool. Privacy-first, no server round-trip.