Hash generator
Runs in your browser; nothing is uploaded
MD5, SHA-1, SHA-256, SHA-384 and SHA-512 hashes and HMACs of text or a file, with a check against a hash you already have.
Input
Hashes
Nothing to hash yet
What is a hash?
A hash function turns any input into a fixed-length fingerprint. The same input always gives the same hash, a one-byte change gives a completely different one, and you can't work back from the hash to the input. MD5 produces 128 bits, SHA-1 160, and SHA-256, SHA-384 and SHA-512 the number of bits in their names, shown here as hex or Base64.
Developers use hashes to check that data hasn't changed: a download page lists a SHA-256 checksum so you can confirm the file you received is the one that was published. An HMAC is a hash mixed with a secret key. Webhook providers and many APIs sign each request with HMAC-SHA256, and the receiver computes the same HMAC over the raw body to prove the request is genuine.
MD5 and SHA-1 are broken for security: attackers can make two different inputs with the same hash. They are still fine for spotting accidental changes, but use SHA-256 or stronger for anything someone might try to forge. A plain hash is also the wrong way to store passwords; that needs a slow, salted algorithm such as Argon2, scrypt or bcrypt.
How to use this tool
- 1Type or paste text into the Input pane. It is hashed as UTF-8, and the hashes update as you type.
- 2To hash a file, choose Hash a file (Ctrl+O) or drop the file on the input. The file's bytes are hashed exactly as they are on disk, in your browser.
- 3Choose the output: hex, uppercase hex or Base64. Copy one hash with the button on its row, or all of them with Copy all.
- 4For an HMAC, switch the mode to HMAC and enter the key, as text or as hex bytes.
- 5To check a hash you were given, paste it into Compare. The tool says which algorithm it matches, whether you pasted hex, Base64 or a line from a checksum file.
Troubleshooting
- My hash doesn't match the one from the command line
- Hashes cover exact bytes.
echoadds a newline, so useecho -norprintf. A trailing space or a different encoding also changes the result. - Text with Windows line endings gives a different hash
- Browsers turn the line endings of text in an editor into
\n, so pasted text is hashed with LF line endings. To hash the exact bytes of a file with CRLF endings, open the file instead of pasting it. - My webhook signature doesn't match
- Compute the HMAC over the raw request body exactly as received, before any JSON parsing or reformatting, with the same key and algorithm. Some providers send the signature in Base64 and others in hex; Compare accepts both.
- The key isn't valid hex
- In hex mode the key must be pairs of the digits 0–9 and a–f. Switch the key format to text to use the key's characters as UTF-8.
Frequently asked questions
Is my text or file sent to a server?
No. SHA-1 and the SHA-2 hashes are computed by your browser's Web Crypto API and MD5 by code on the page. Files are read in the browser, up to 200 MB, and nothing leaves your device.
Can I reverse or decrypt a hash?
No. Hashing is one-way. Sites that claim to reverse MD5 look the hash up in tables of hashes of common words and passwords, which only works for weak inputs.
Which algorithm should I use?
SHA-256 for checksums, signatures and anything security related. SHA-384 and SHA-512 are also safe. Use MD5 or SHA-1 only where an existing system requires them.