Hash Generator
Create MD5, SHA-1, SHA-256, SHA-512 and HMAC hashes of text or files.
What is a hash?
A hash function turns any amount of data into a short, fixed length fingerprint. The same input always produces the same hash, but changing even one character produces a completely different result. Hashes are used to check that files downloaded correctly, to detect changes, to build caches and to sign API requests. This generator calculates five common hashes at once: MD5, SHA-1, SHA-256, SHA-384 and SHA-512.
How to generate a hash
- Type or paste text into the box. The hashes update as you type.
- Or drop a file onto the upload area to calculate its checksums.
- Tick Uppercase hex if your system expects capital letters.
- Paste a published checksum into Compare with to see whether it matches.
- Copy a single hash, copy them all, or download them as a text file.
Features
- Five algorithms calculated together, so you do not need to know in advance which one you need.
- File checksums for files up to 1 GB, read directly on your device.
- Checksum comparison that highlights the matching algorithm.
- HMAC-SHA256 signatures from a secret key and message, in hex or Base64.
- UTF-8 text encoding, which matches what most programming languages and command line tools do.
Which hash should I use?
SHA-256 is the best general choice today. It is used for software downloads, blockchain systems, Git and digital signatures. SHA-384 and SHA-512 give longer outputs for extra safety margins. MD5 and SHA-1 are fast and still common for checking accidental corruption, but they are broken for security purposes because researchers can create two different inputs with the same hash. Do not use them for signatures or certificates.
None of these plain hashes should be used to store passwords. Password storage needs a slow, salted algorithm such as bcrypt, scrypt or Argon2.
What is HMAC?
HMAC combines a hash with a secret key. Only someone who knows the key can create the same signature, which is why payment providers, webhooks and many APIs use HMAC-SHA256 to prove a message really came from them. Enter the key and the exact message body to reproduce a signature while debugging an integration.
Tips
When a file checksum does not match, download the file again before assuming it was tampered with, because incomplete downloads are the most common cause. When hashing text, remember that a trailing space or line break changes the result. If you are reproducing a webhook signature, hash the raw request body exactly as it was received, before any JSON parsing or reformatting, because even a changed space produces a different signature.
Frequently asked questions
Are my files uploaded to calculate the hash?
No. Files are read and hashed in your browser. Nothing leaves your device.
Can a hash be reversed to get the original text?
No. Hash functions are one way. Short or common inputs can sometimes be guessed with lookup tables, which is why passwords need special slow algorithms.
Why do I only see MD5?
Browsers only allow the built-in SHA and HMAC functions on secure HTTPS pages. On an insecure connection the tool falls back to its own MD5 code and shows a notice.
Does the text hash match command line tools?
Yes, as long as the input is identical. Note that echo adds a line break by default, so use echo -n or printf to get the same result.