How to use the Hash Generator
- Choose Text and type or paste your input, or choose File and drop in the file you want to check.
- Read all five hashes at once: MD5, SHA-1, SHA-256, SHA-384 and SHA-512.
- Switch the output between lowercase hex, uppercase HEX and Base64 to match the format you need.
- Tick HMAC mode and enter a key to create a keyed hash, for example to test webhook signatures.
- Paste a published checksum into the compare box to confirm that your file matches it.
Features
- Five algorithms calculated together
- Text and file hashing, with progress for large files
- HMAC for MD5 and the whole SHA family
- Hex, uppercase hex or Base64 output
- Checksum comparison that recognizes sha256sum-style lines
- Everything runs locally; files are never uploaded
What a hash function does
A cryptographic hash function turns input of any size into a short, fixed-length fingerprint called a digest. Three properties make it useful. It is deterministic: the same input always gives the same hash. It is one-way: you cannot work backwards from the hash to the input. And it shows an avalanche effect: changing a single character produces a completely different result. The SHA-256 of hello is 2cf24dba5fb0a30e, while Hello with a capital H gives 185f8db32271fe25.
Comparing the algorithms
| Algorithm | Output size | Hex length | Status |
|---|---|---|---|
| MD5 | 128 bits | 32 | Broken for security; fine for spotting accidental corruption |
| SHA-1 | 160 bits | 40 | Broken for security since a practical collision in 2017 |
| SHA-256 | 256 bits | 64 | Secure; the everyday default |
| SHA-384 | 384 bits | 96 | Secure; a truncated SHA-512 variant |
| SHA-512 | 512 bits | 128 | Secure; often faster than SHA-256 on 64-bit CPUs |
“Broken” means researchers can deliberately create two different inputs with the same hash (a collision). That rules MD5 and SHA-1 out for digital signatures and certificates, but they still detect random damage such as a truncated download. When you have a choice, use SHA-256.
Verifying a download
Software projects often publish a checksum next to each download. After downloading, drop the file into this tool, paste the published value into the compare box, and the matching algorithm is highlighted. If nothing matches, the file is incomplete, corrupted or not the one the publisher released. You can paste a line straight from a SHA256SUMS file; the tool picks out the hash and ignores the file name.
HMAC: hashing with a key
A plain hash proves that data has not changed, but anyone can recompute it. HMAC (RFC 2104) mixes a secret key into the calculation, so only someone who knows the key can produce the right value. Payment providers, GitHub and many other services sign webhook requests with HMAC-SHA256: they send the HMAC of the request body in a header, and your server recomputes it with the shared secret. This tool is handy for checking those values by hand. Make sure you hash the exact raw body, byte for byte.
Common mistakes
- Invisible characters.
echo hello | sha256sumhasheshelloplus a line break, which gives a different result from typinghellohere. Useecho -norprintfon the command line. - Different text encodings. This tool hashes text as UTF-8. Tools that use UTF-16 or Latin-1 produce different hashes for accented letters.
- Hashing passwords with SHA-256. Fast hashes can be guessed billions of times per second. Store passwords with a slow, salted algorithm designed for the job, such as Argon2, bcrypt or scrypt.
- Calling hashing encryption. A hash cannot be decrypted. To make data reversible, use encryption; to make it text-safe, use Base64.
Frequently asked questions
Can a hash be reversed to get the original text?
No. Hash functions are one-way. Short or common inputs can sometimes be found by guessing and comparing, which is why passwords need slow, salted hashing.
Which hash algorithm should I use?
Use SHA-256 unless a system asks for something else. Use MD5 or SHA-1 only for compatibility or for detecting accidental corruption, never for security.
Why does my hash differ from the one my terminal shows?
The input is almost always slightly different, typically a trailing newline added by echo, a different text encoding or extra spaces. Hashes change completely with any one-byte difference.
Is my file uploaded to calculate the hash?
No. The file is read and hashed inside your browser using JavaScript and the Web Crypto API. Nothing is sent over the network.
What is the difference between a hash and an HMAC?
A hash depends only on the data. An HMAC also depends on a secret key, so it proves both that the data is unchanged and that it came from someone who knows the key.