Digests, HMAC and bcrypt explained

These operations solve different problems. A digest is unkeyed, HMAC uses a secret key to authenticate a message, and bcrypt is a salted password-hashing function. None is encryption.

Digest versus authentication

SHA-256 and SHA-512 produce fixed-size digests of exact input bytes. Comparing a digest obtained through an untrusted channel does not establish who created a file. HMAC-SHA-256 and HMAC-SHA-512 combine a message with a secret key; everyone with that key can generate a valid tag. Keys must remain confidential, and applications should verify tags with an appropriate constant-time routine.

MD5 is legacy-only

MD5 has practical collision weaknesses. It is retained only for compatibility checks with old formats, not signatures, security-sensitive integrity checks or password storage. Fast hashes such as SHA-256 and SHA-512 are also unsuitable by themselves for storing passwords. Encoding a value in Base64 or hexadecimal does not make it secret.

What bcrypt does

bcrypt generates a salted hash and provides a separate verification operation. The prototype runs it only after an explicit action, in a bounded worker. It generates at costs 10–12 and rejects more than 72 UTF-8 bytes rather than truncating silently. Non-ASCII characters may occupy several bytes. Verification accepts bounded legacy costs; that does not endorse those costs for new password databases.

Exact input and safe handling

The prototype hashes exact UTF-8 text without normalization. A newline, different Unicode representation or extra space changes the result. It is not a binary-file hashing tool. HMAC keys and test passwords belong only in the separate ad-free workspace after deployment isolation is verified. This educational page has no secret fields. No deterministic master-password feature is provided.

Tools do not remove your applicable legal rights or our responsibilities under applicable law. No security or liability immunity is promised.