SHA-256, MD5 and HMAC hash generator
MD5, SHA-1, SHA-256, SHA-384 and SHA-512 of text or a file, with optional HMAC and a checksum check. Everything runs in your browser: nothing is uploaded.
By using these tools you accept the Terms and the Privacy page.
How the hash generator works
The hash generator works out the MD5, SHA-1, SHA-256, SHA-384 and SHA-512 digests of text or a file in one go, and HMACs when you add a key. It is for developers, system administrators and anyone checking a download against a published checksum. All five results appear together, so whichever of them a project publishes, its value is already on screen.
Reading the results
Each row names the algorithm and its length in bits: 128 for MD5, 160 for SHA-1, then 256, 384 and 512 for the SHA-2 family. In plain hash mode, MD5 and SHA-1 carry a Not for security badge. The output can be lowercase hex, uppercase hex or Base64. Pick the form your system expects; the value is the same, only written differently.
Below the list, the page shows what was hashed: the character count and the UTF-8 byte count for text, or the file’s name and exact size in bytes, and how long it took. When your hash doesn’t match one made elsewhere, compare the byte counts first: a different count means different input.
A file is read in pieces with a progress bar while MD5 is worked out; then the browser’s WebCrypto makes the four SHA hashes one after another, and for files over 16 MB the page names the one running and, after 3 seconds, counts the seconds.
How the checksum compare works
Paste a published checksum into the compare box and the page tests it against every result. It also reads hex with spaces or colons between the bytes, BSD-style lines such as SHA256 (file.iso) = …, sha256=… and sha256:… values, and a pasted certutil or Get-FileHash line with one hex value in it. When the value names its algorithm, only that algorithm is compared. The main verdicts:
- Match: the verdict names the algorithm. For a plain MD5 or SHA-1 match it adds that whoever made the file could have made a different one with the same hash, and suggests a SHA-256 checksum when one is published.
- No match: an algorithm gives a hash of the same length but a different value. For a file, that means a corrupted or different download, or a checksum for another file. For text, look for a stray space or line break at the end.
- Wrong length: no algorithm here gives a hash of that length. MD5 is 32 hex characters, SHA-1 40, SHA-256 64, SHA-384 96 and SHA-512 128. Check that you copied the whole value.
HMAC mode
Tick HMAC with a secret key and the SHA rows become HMAC-SHA-1, HMAC-SHA-256, HMAC-SHA-384 and HMAC-SHA-512, as defined in RFC 2104. HMAC-MD5 isn’t offered. A hex key may have spaces or colons between bytes; an odd number of hex digits is refused. The compare box works here too: enter the exact message that was signed and the shared key, then paste only the hex or Base64 signature you received.
Related checks
- HS256, HS384 and HS512 tokens are HMACs over the token’s first two parts. The JWT decoder checks them with the secret and explains the claims.
- An HMAC key should be long and random. The Password generator makes one.
Updated · Maintained by Liviu Tanase
Questions
Is my text or file uploaded?
No. Hashing runs in your browser: MD5 with this page’s own code, SHA-1 and SHA-2 with the browser’s WebCrypto API. A file is read from your disk and never uploaded, and nothing you type is sent anywhere or put in the address bar.
Why doesn’t my hash match the one from the command line?
Usually a line break. echo abc | sha256sum hashes “abc” plus a newline; use printf abc or echo -n abc. Text here is hashed as UTF-8 with LF line breaks, so a file saved with Windows CRLF line breaks hashes differently from the same text pasted here. For an exact match, hash the file itself.
Are MD5 and SHA-1 safe to use?
Not for security. Collisions, two different inputs with the same hash, can be made for both: for MD5 in seconds, for SHA-1 since 2017 (SHAttered). Use them only to catch accidental corruption, such as checking a download against a published checksum. For signatures, certificates and anything an attacker could tamper with, use SHA-256 or stronger.
Can I hash passwords with this?
Don’t store passwords as any of these hashes. They are fast, even SHA-512, so attackers can test billions of guesses a second against a leaked hash. Store passwords with a slow password hash such as Argon2id, scrypt or bcrypt, with a unique salt for each.
What is an HMAC?
A hash mixed with a secret key (RFC 2104). Only someone with the key can make or check it, so it proves a message came from a key holder and wasn’t changed. Webhooks from Stripe, GitHub and Slack are signed this way, usually with HMAC-SHA256. The key here can be text, hex or Base64.
How do I check a download’s checksum?
Open the File tab, choose the file and paste the published checksum into the compare box. Hex in any case, Base64, a line from sha256sum, shasum, certutil or Get-FileHash, and an SRI value such as sha384-… all work. The page says which algorithm matches, or that none does.
How do I check a webhook signature (HMAC-SHA256)?
Tick HMAC, enter the signing secret as text and paste the raw request body, exactly as received, into the Text tab. GitHub’s sha256=… header value can go into the compare box as is. Stripe signs the t= timestamp, a dot and the body; compare its v1 hex. Text here has LF line breaks, so hash a body with CRLF as a file. For HS256 tokens use the JWT decoder.
Hex or Base64: which output do I need?
The same bytes, written differently. Download pages and sha256sum use hex; Subresource Integrity (integrity="sha384-…") and some APIs use Base64. The compare box reads both. To encode or decode other data, use the Base64 encoder.
How large a file can I hash?
Up to 2 GB. The file is read in pieces with a progress bar and MD5 is worked out as it reads; WebCrypto then hashes the whole file at once, so it has to fit in memory (briefly about twice its size), and the page shows which hash is running. Above 500 MB this can be slow, especially on phones. For bigger files use shasum -a 256 file (macOS), sha256sum file (Linux) or certutil -hashfile file SHA256 (Windows).