Open menu

Hash Generator (SHA-256, SHA-512, MD5)

Hash any text or file with five algorithms at once and get the results in lowercase hex, uppercase hex or Base64. Paste the checksum published with a download to confirm the file is intact. Turn on HMAC to sign data with a secret key, as webhook and API signatures do. SHA hashing uses your browser's Web Crypto, MD5 is computed locally for legacy checksums, and files up to 200 MB are processed without leaving your device.

Output

Input

43 characters

or drop it here. It stays on your device.

Output

AlgorithmHashCopy

Checks

  • Info MD5 and SHA-1 are broken for security (collisions can be made on purpose). Use them only for checksums and legacy systems; use SHA-256 or stronger otherwise. Never store passwords as plain hashes: use a slow password hash such as Argon2 or bcrypt.

Runs entirely in your browser. Nothing you paste or open here is uploaded or stored.

How to use the hash generator

  1. Type or paste text, or choose a file (up to 200 MB) to hash its exact bytes.
  2. Read all five hashes in the table and copy the one you need.
  3. Choose the output format: lowercase hex (most common), uppercase hex or Base64.
  4. To verify a download, paste the published checksum into the comparison box. It’s matched against every algorithm, in any case or encoding.
  5. For HMAC, switch it on and enter the secret key.

How hashing works

A cryptographic hash turns any amount of data into a fixed-size fingerprint: 128 bits for MD5, 160 for SHA-1, and 256, 384 or 512 for the SHA-2 family. Three properties make it useful:

  • Deterministic: the same input always gives the same hash.
  • Avalanche effect: changing one bit changes about half the output bits.
  • One-way: you can’t reconstruct the input or find another input with the same hash, at least for unbroken algorithms.

SHA hashes are computed by the browser’s built-in Web Crypto API, which is fast and well tested. Web Crypto deliberately leaves out MD5, so the tool includes a small RFC 1321 implementation, tested against the standard’s own examples.

Worked examples

Example 1: the classic test sentence

Hash The quick brown fox jumps over the lazy dog. SHA-256 is d7a8fbb3…37c9e592. Add a full stop at the end and every character of the hash changes. That’s the avalanche effect.

Example 2: verifying a download

A project publishes SHA256: 3f5a… next to its installer. Choose the downloaded file, paste the value, and the check says Matches the expected SHA-256 hash. If it doesn’t match, the file is corrupted or not the official one, so don’t run it.

Example 3: checking a webhook signature

A service sends a header with HMAC-SHA256 of the request body. Paste the raw body, turn on HMAC, enter your webhook secret, and compare the hex or Base64 value with the header. They must match exactly; any reformatting of the body breaks the signature.

Which algorithm when

  • SHA-256: default for checksums, file integrity, Git-style content IDs and HMAC.
  • SHA-512: often faster than SHA-256 for large data on 64-bit CPUs without SHA-256 hardware acceleration; required by some standards.
  • SHA-1 and MD5: still seen in old checksums and caches. Fine for detecting accidental corruption, useless against an attacker.

Common mistakes

  • Hashing passwords with a fast hash. Use Argon2id, scrypt or bcrypt.
  • Comparing hashes of text with different line endings. CRLF and LF give different results.
  • Thinking a hash encrypts data. It can’t be decrypted, but short or common inputs can be guessed.
  • Trusting a checksum from the same compromised page. Get checksums from an official, separate source when security matters.

Frequently asked questions

Which hash should I use?

SHA-256 for almost everything: checksums, content addressing, signatures. SHA-384 or SHA-512 when a standard asks for them. MD5 and SHA-1 only for compatibility with old systems, because deliberate collisions can be created for both.

Can I hash passwords with SHA-256?

No. General-purpose hashes are designed to be fast, which makes guessing passwords fast too. Store passwords with a slow, salted password-hashing function such as Argon2id, scrypt or bcrypt.

What is an HMAC?

A hash-based message authentication code combines a secret key with the data. Only someone who knows the key can produce the same value, so services like payment providers and code-hosting webhooks use HMAC-SHA256 to prove a request is genuine.

Why does my hash differ from another tool's?

Usually invisible differences in the input: a trailing newline, Windows line endings (CRLF vs LF), or a different text encoding. This tool hashes text as UTF-8 exactly as typed.

Can a hash be reversed to get the original text?

No. Hashes are one-way, but short or common inputs can be guessed by trying many candidates, which is why passwords need a slow, salted algorithm instead.

Sources