Hash Generator & Checksum Verifier

Get MD5, SHA-1, SHA-256, SHA-384 and SHA-512 for any text or file at once, compute HMACs with a secret key, and check a file against a published checksum.

Runs in your browserNo sign-upNothing uploaded

Verify a checksum

How to use the Hash Generator

Type or paste text, or switch to File and drop a file. Large files are read in chunks with a progress bar.
All five hashes are calculated at once. Choose lowercase hex, uppercase HEX or Base64 output.
Tick HMAC and enter a secret key (as text, hex or Base64) to get keyed HMAC-SHA256 and the other HMAC variants.
To verify a download, paste the published checksum into Verify a checksum. The matching algorithm is highlighted.

What is a hash?

A cryptographic hash function turns any input into a fixed-length fingerprint. The same input always gives the same hash, a one-byte change gives a completely different one, and you cannot reverse a hash back into its input. That makes hashes ideal for checking file integrity, building cache keys, deduplicating data and signing messages.

Which algorithm should I use?

Algorithm	Output	Use it for
MD5	128 bit · 32 hex	Legacy checksums and non-security cache keys only. Collisions are easy to create.
SHA-1	160 bit · 40 hex	Git object IDs and old systems. Broken for collision resistance since 2017.
SHA-256	256 bit · 64 hex	The default choice: download checksums, signatures, blockchains, API request signing.
SHA-384 / SHA-512	384 / 512 bit	Higher security margins; SHA-512 is often faster than SHA-256 on 64-bit CPUs.

Do not use any of these to store passwords. They are designed to be fast, which helps attackers. Use a slow password hash such as Argon2id, scrypt or bcrypt instead.

Verifying a file checksum

Software vendors often publish a SHA-256 next to each download. Drop the file here, paste the published value and the tool tells you whether they match. You can paste the line straight from a SHA256SUMS file; the file name after the hash is ignored. Equivalent commands:

sha256sum file.iso          # Linux
shasum -a 256 file.iso      # macOS
certutil -hashfile file.iso SHA256   # Windows

What is HMAC?

HMAC (RFC 2104) mixes a secret key into the hash, so only someone with the key can produce or check the value. Webhooks from Stripe, GitHub and Slack are signed with HMAC-SHA256, and JWTs with the HS256 algorithm use it too. Paste the raw request body and your signing secret to reproduce a signature while debugging.

Frequently asked questions

Are my files uploaded to compute the hash?

No. Text and files are hashed locally with the browser’s Web Crypto API (and a built-in MD5 implementation). Nothing leaves your device.

Why does my hash differ from another tool’s?

Usually the input differs: a trailing newline, Windows line endings (CRLF vs LF) or a different text encoding. This tool hashes text as UTF-8 exactly as typed, without adding a newline. Note that echo "text" | sha256sum includes a newline; use echo -n.

Can a hash be decrypted?

No. Hashing is one-way. Sites that “decrypt” MD5 or SHA-1 simply look the value up in tables of hashes of common inputs, which is why short or common strings are not safe to hash without a secret.

Is SHA-256 the same as SHA-2?

SHA-256 is one member of the SHA-2 family, which also includes SHA-224, SHA-384 and SHA-512. SHA-3 is a different, newer design.

How large a file can I hash?

Up to 2 GB, limited by browser memory. Files are read in 4 MB chunks with a progress bar so the page stays responsive.