Hash generator

How to use

1. Pick Text to type or paste content, or File to choose (or drag in) a file from your device.
2. The MD5, SHA-1, SHA-256, SHA-384 and SHA-512 hashes show up instantly, all at once. Switch the format between hex (lowercase), HEX (uppercase) and Base64, and copy each one with a tap.
3. To verify a download, paste the checksum published by the website into Compare with the expected hash. The tool figures out the algorithm by itself and tells you whether it matches.
4. Need to sign a message? Turn on HMAC and enter the secret key (as text, hexadecimal or Base64).

Verifying a downloaded file

Operating system, software and database websites usually publish the SHA-256 of each file. Choose the downloaded file in the File tab, paste the published value (the whole sha256sum line with the file name works too, as does the output of Windows certutil -hashfile or PowerShell Get-FileHash) and check the result. If it doesn't match, the file is corrupted or was tampered with: download it again, ideally from the official site. Large files of several GB work fine: the file is read in parts, in the background, with a progress bar and a cancel button, and the page stays responsive.

What a hash is

A hash function turns any content, from a single word to a whole movie, into a fixed-size "fingerprint". Four properties explain why it's so useful:

• Deterministic: the same content always produces the same hash, on any computer.
• Fixed size: SHA-256 is always 256 bits (64 hex characters), whether the input is one byte or one terabyte.
• One-way: you can't rebuild the original content from the hash.
• Avalanche effect: changing a single letter changes the hash completely. Try typing "Hello" and then "hello".

Which algorithm to use

• SHA-256 is today's standard for integrity and security: use it when in doubt.
• SHA-384 and SHA-512 belong to the same family, with a longer output. SHA-512 is often even faster on 64-bit processors.
• MD5 and SHA-1 are broken for security: it's possible to craft two different files with the same hash. They still catch accidental corruption and show up in older systems, but don't use them for signatures, certificates or proving authenticity.

Hashing vs. encryption vs. encoding

They're different things, and mixing them up is a common mistake:

• Hashing is one-way and has no key: it's for verifying, not hiding.
• Encryption is reversible by whoever has the key: it's for keeping secrets.
• Encoding (like Base64) only changes how data is represented: anyone can undo it, no key needed.

HMAC in plain words

HMAC is a hash computed together with a secret key. Without the key nobody can produce the same value, so it proves two things: the message wasn't changed, and it came from someone who knows the key. That's how payment providers, online stores and messaging platforms sign the webhooks they send to your system.

Passwords: don't use a plain hash

Storing passwords as plain MD5 or SHA-256 is a classic mistake. These algorithms are designed to be fast, which helps attackers: a single graphics card tries billions of guesses per second. For passwords, use slow, salted functions built for the job: bcrypt, scrypt or Argon2.

Common pitfalls

• Line endings: Windows uses CRLF, Linux and macOS use LF. The same text with different line breaks produces different hashes. To check a text file, use the File tab, which reads the exact bytes.
• Trailing newline: in a terminal, echo "text" | sha256sum adds a line break at the end. Use echo -n to match the hash of the bare text.
• Encoding: text here is converted to UTF-8. A file saved in another encoding (such as Latin-1) has different bytes for accented letters.
• Upper vs. lowercase: AB12 and ab12 in hex are the same hash. This tool's comparison ignores the difference.

Privacy

All hashing happens in your browser. Text and files are never sent to a server and nothing is stored. Once the page has loaded, the tool works even without an internet connection.