Generate MD5, SHA-1, SHA-256 and SHA-512 hashes
MD5, SHA-1, SHA-256, SHA-384 and SHA-512 of text or a file, with HMAC and checksum comparison.
Loading tool…
A hash is a fixed-length fingerprint of data: change one byte and the fingerprint changes completely. People use hashes to check that a download arrived intact (the site publishes a SHA-256 and you compare), to detect duplicate files, to create cache keys and ETags, and, with a secret key as an HMAC, to sign API requests and verify webhooks from services such as Stripe, GitHub or Shopify.
This generator computes MD5, SHA-1, SHA-256, SHA-384 and SHA-512 at once, for text as you type or for a file you drop. Text is hashed as UTF-8 exactly as entered, so a trailing space or a Windows line break gives a different result, which is the most common reason two hashes of "the same" text disagree. Output can be lowercase hex, uppercase hex or Base64. Paste a published checksum into the compare box and the matching algorithm lights up; prefixes such as "sha256:" and differences in letter case are ignored.
The SHA family and their HMACs use your browser's Web Crypto API; MD5, which Web Crypto does not offer, is implemented in the page from RFC 1321 and checked against the RFC's test vectors, as are the SHA and HMAC results. Files up to 1 GB are read on your device and never uploaded. A caution worth repeating: MD5 and SHA-1 are fine for spotting accidental corruption but are broken against deliberate attacks, and no plain hash is suitable for storing passwords; use a slow password hash such as Argon2 or bcrypt on your server for that.
How to use it
- Choose Text or File. Type or paste text, or drop any file.
- Tick the algorithms you need (all five are on by default) and pick hex or Base64 output.
- For an HMAC, turn on "HMAC with a secret key" and enter the key as text or hex.
- Copy a hash, or paste an expected checksum into the compare box to verify a download.
Frequently asked questions
How do I verify a downloaded file?
Choose File, drop the download, and paste the checksum from the publisher's site into the compare box. A match means the file is byte-for-byte what they published.
Why does my hash differ from another tool's?
Usually the input differs: a trailing newline, spaces, Windows line endings (CRLF) or a different text encoding. This tool hashes UTF-8 bytes exactly as typed.
Is MD5 still safe to use?
For checking accidental corruption, yes. For security (signatures, certificates, passwords), no: MD5 and SHA-1 collisions can be produced deliberately. Use SHA-256 or stronger.
What is HMAC?
A hash mixed with a secret key (RFC 2104). Only someone with the key can produce the same value, which is how APIs and webhooks prove a message is genuine and unchanged.
Can I hash files larger than 1 GB?
Not here: the browser's hashing API needs the whole file in memory. Use sha256sum or certutil -hashfile on your computer for very large files.
Related tools
- Encode or decode Base64Encode text to Base64 or decode Base64 back to text, UTF-8 safe, with a URL-safe option.
- Random password generatorRandom passwords from crypto.getRandomValues, 8 to 64 characters, with the entropy in bits and a strength label.
- Generate UUIDs (v4 or v7)Generate 1 to 100 random UUID v4 or time-ordered UUID v7 identifiers with crypto-grade randomness.
- Decode a JWT (without sending it anywhere)Decode a JSON Web Token's header and payload and see whether it has expired. Signature is not verified; the token stays in your browser.
- URL-encode or decode textPercent-encode text for URLs (encodeURIComponent or encodeURI) or decode an encoded string.
- Minify JSONStrip every unnecessary space and line break from JSON and see how many bytes you saved.