How to use the Hash Generator tool
- Choose text or fileType or paste text, or switch to File and drop any file to calculate its checksum.
- Read the hashesMD5, SHA-1, SHA-256, SHA-384 and SHA-512 are calculated instantly and update as you type.
- Verify a checksumPaste the expected hash into “Compare with a hash” and the matching algorithm is highlighted.
- Copy the resultClick “Copy” next to any hash. Use the options for uppercase or Base64 output.
Features
- All common algorithmsSee five hashes side by side, so you never have to guess which one a site used.
- File checksumsVerify that a download or backup is complete and unmodified, even for large files.
- HMAC signaturesAdd a secret key to create HMAC-MD5 or HMAC-SHA signatures, as used by webhooks and APIs.
- Instant comparisonPaste a published checksum and get a clear match or no-match result.
- PrivateHashing runs in your browser. Your text and files are never uploaded.
What is a hash?
A cryptographic hash function turns any input, a word, a document or a 4 GB video, into a short fixed-length fingerprint. The same input always gives the same hash, but changing even one character produces a completely different result. And you cannot work backwards from the hash to the original data. That makes hashes ideal for checking that data hasn’t changed.
Which algorithm should I use?
| Algorithm | Length | Status | Good for |
|---|---|---|---|
| MD5 | 128 bits (32 hex) | Broken for security | Quick checksums, cache keys, legacy systems |
| SHA-1 | 160 bits (40 hex) | Broken for security | Git object IDs, legacy compatibility |
| SHA-256 | 256 bits (64 hex) | Secure | File verification, signatures, the modern default |
| SHA-384 | 384 bits (96 hex) | Secure | TLS, Subresource Integrity |
| SHA-512 | 512 bits (128 hex) | Secure | High-security uses; often fast on 64-bit CPUs |
MD5 and SHA-1 still detect accidental corruption well, but researchers can deliberately create two different files with the same MD5 or SHA-1 hash. Use SHA-256 or stronger whenever someone might tamper with the data on purpose.
How to verify a downloaded file
- Find the checksum published on the official download page (often labelled SHA-256 or “checksum”).
- Switch this tool to File and drop the downloaded file.
- Paste the published value into Compare with a hash. A green “match” means the file is complete and identical to the original.
Hashes are not for storing passwords
A fast hash like SHA-256 is the wrong tool for storing passwords, because attackers can try billions of guesses per second. Websites should use a slow, salted password-hashing function such as Argon2, bcrypt or scrypt. If you need a strong password in the first place, try our Password Generator.
What is HMAC?
HMAC combines a hash with a secret key. Only someone who knows the key can produce the correct value, so services such as payment providers and webhooks use HMAC-SHA256 to prove that a message really came from them and wasn’t altered. Enter the key in the HMAC field to calculate the signature. To inspect a signed token, see the JWT Decoder.