Hash generator

Type or paste text, or choose a file of any size, and see its SHA-256, SHA-512, SHA-1 and MD5 hashes at once. Paste the checksum a download page publishes to check the file, and add a secret key for HMAC-SHA256 and HMAC-SHA512 signatures.

Exactly the bytes you typed

Text is hashed as UTF-8, with nothing added at the end, so the result matches echo -n "text" | sha256sum. Hex is lower case; Base64 is shorter, as some APIs expect.

HMAC signatures

With a key, HMAC-SHA256 and HMAC-SHA512 sign the text or file the way webhook senders and many APIs do: compute the signature of a payload to check one you received. The key is kept only while the page is open, and never saved.

Files of any size

Choose or drop a file and it is read in pieces by background threads, one per hash, so a disk image of several gigabytes is hashed without filling the memory or freezing the page. A bar shows how far it has got. The file stays on your device.

Check a download

Paste the hash from the download page into Expected hash. The matching row turns green; if none matches, the page says so, and a mismatch means the file was damaged or changed on the way.

  • A hash on its own, in hex or Base64
  • A line as sha256sum and md5sum print it, or as BSD does: SHA256 (file) = hash
  • A whole SHA256SUMS list: the line naming your file is used
  • Docker digests (sha256:…) and subresource-integrity values (sha256-…)

Which hash?

  • SHA-256: the usual choice for checksums, signatures and content addresses
  • SHA-512: a longer hash, sometimes faster on 64-bit machines
  • SHA-1 and MD5: for checksums and older systems only, as they are no longer safe against deliberate collisions

For storing passwords use none of them directly: use a slow password hash such as bcrypt or Argon2.

Private

Text is hashed with Web Crypto (and our own code for MD5); files by our own code, as Web Crypto only hashes what fits in memory at once. Everything happens in your browser: nothing is sent anywhere, and nothing is saved.

Questions

Can a hash be turned back into the text?

No. But short or common texts can be found by trying guesses, which is why passwords need a slow password hash.

Why does my hash differ from another tool?

Usually because of a line break at the end, or a different text encoding. Here exactly the characters typed are hashed, as UTF-8.

How do I verify a downloaded file?

Choose File, pick the download, and paste the checksum from the publisher's page into Expected hash. A green row means the file is exactly the one they published.

More tools