Hash Generator
MD5, SHA-1 and SHA-2 hashes and HMACs of text or files.
About this tool
Compute MD5, SHA-1, SHA-256, SHA-384 and SHA-512 of any text or file, or an HMAC with a secret key. Files are read locally and never uploaded, so it works for checking download checksums too.
How to use it
- Choose Text or File as the input.
- Type text or drop a file. Files are read locally and never uploaded.
- Read MD5, SHA-1, SHA-256, SHA-384 and SHA-512 at once, in hex or Base64.
- For signed messages, turn on HMAC and enter the secret key.
Questions
- How do I verify a downloaded file?
- Choose File, drop the download, and compare the SHA-256 value with the checksum published by the project. If even one character differs, the file is not the same.
- Can I use MD5 or SHA-1 for passwords?
- No. They are too fast and have known weaknesses. Store passwords with a slow password hash such as Argon2, bcrypt or scrypt.
- What is an HMAC?
- A hash combined with a secret key. It proves that a message came from someone who knows the key and wasn’t changed. Webhooks from services like Stripe and GitHub are signed this way.
- Why does my hash differ from another tool?
- Usually because of invisible differences in the input: a trailing newline, Windows line endings, or a different text encoding. Here, text is always hashed as UTF-8 exactly as typed.
- Can a hash be decrypted or reversed?
- No. A hash is not encryption, and there is no key to undo it. Sites offering to “decrypt MD5” look the value up in huge tables of hashes of common strings. That is also why unsalted hashes of short inputs, like passwords or phone numbers, don’t make data anonymous.
- How do I verify a webhook HMAC signature?
- Turn on HMAC, enter the signing secret, and paste the raw request body exactly as received, then compare the HMAC-SHA256 hex value with the signature header. GitHub sends it in X-Hub-Signature-256 after a sha256= prefix. Reformatted JSON gives a different result, and some providers also sign a timestamp, so check their docs.
- How can I tell which algorithm produced a hash?
- Look at its length in hex. MD5 has 32 characters, SHA-1 has 40, SHA-256 has 64, SHA-384 has 96 and SHA-512 has 128. The length doesn’t prove the algorithm, since other hashes share these sizes, but it narrows it down quickly. Hash a known input here to confirm.
What is a hash function?
A cryptographic hash function turns input of any size into a fixed-size digest. SHA-256 always produces 256 bits, shown as 64 hex characters, whether you hash one word or a 4 GB file. The same input always gives the same hash, and changing a single bit changes about half of the output. You can’t reverse a hash to get the input back; you can only hash guesses and compare the results.
A good hash is also collision resistant: finding two inputs with the same digest should be practically impossible. MD5 and SHA-1 have lost that property. A real SHA-1 collision was published in 2017 (SHAttered), and MD5 collisions take seconds on a laptop. Both are still fine for spotting accidental corruption, but use SHA-256 or SHA-512 for signatures, tamper checks and anything else where an attacker might be involved.
How to get the same SHA-256 hash on the command line
To compare with a value from the terminal, hash exactly the same bytes. On Linux run sha256sum file.iso, on macOS shasum -a 256 file.iso, and in Windows PowerShell Get-FileHash file.iso, which defaults to SHA-256. For MD5 the commands are md5sum, md5 and Get-FileHash -Algorithm MD5. PowerShell prints uppercase hex, so turn on Uppercase here when you want the two values to look identical.
For text, remember that echo adds a newline, so echo hello | sha256sum hashes six bytes, not five. Use printf hello | sha256sum or echo -n to match what you typed here; the byte count above the text box confirms the exact input. Some systems, such as Subresource Integrity attributes, expect the digest in Base64 rather than hex. Switch the output encoding to get it without converting by hand.
MD5 vs SHA-1 vs SHA-256 vs SHA-512: which hash to use
For new work, SHA-256 is the default: fast, supported everywhere, and without known practical attacks. SHA-512 gives a longer digest and is often faster than SHA-256 on 64-bit CPUs, which helps with large files. SHA-384 is a truncated SHA-512 with different starting values, common in TLS and Subresource Integrity. Keep MD5 and SHA-1 for legacy systems and non-security checksums, such as matching a file against an old published MD5.
To authenticate a message, such as a webhook payload, use an HMAC instead of hashing the secret together with the message. A plain SHA-256 of secret plus message is open to length-extension attacks, which HMAC was designed to prevent. Passwords need a slow, salted algorithm like Argon2id or bcrypt instead of any of these. For random IDs or secret tokens, use the UUID Generator or Password Generator rather than a hash.
Something not working, or a result looks wrong? Report a problem with this tool