Hash Generator

Generate MD5, SHA-1, SHA-256, SHA-384 and SHA-512 hashes of text or files, sign messages with HMAC and verify checksums. Hashing runs locally with your browser's Web Crypto API.

Text & filesHMAC signingNothing uploaded

Input

HMAC secret key (optional)

Uppercase Base64 output

Verify against a checksum

Hashes

Which hash algorithm should I use?

SHA-256 is the everyday default: used for file checksums, Git (newer repositories), TLS certificates and Bitcoin.
SHA-384 / SHA-512 give longer digests and are often faster than SHA-256 on 64-bit machines.
SHA-1 and MD5 are kept for legacy checksums and compatibility. Don't use them where an attacker could forge a collision.
HMAC combines a hash with a secret key to prove a message wasn't tampered with. It's how webhooks from Stripe, GitHub and Slack are signed.

Text is hashed as UTF-8. Line endings matter: a file saved with Windows line endings (CRLF) has a different hash to the same text with Unix line endings (LF).

FAQ

What is a hash?

A cryptographic hash function turns any input into a fixed-length fingerprint. The same input always gives the same hash, and changing a single character changes the hash completely, which makes hashes ideal for checking file integrity.

Is MD5 still safe to use?

MD5 and SHA-1 are broken for security purposes because collisions can be created deliberately. They're still fine for non-security checksums, but use SHA-256 or stronger for anything security-related.

Should I hash passwords with SHA-256?

No. Plain hashes are too fast to resist brute force. Store passwords with a slow, salted algorithm designed for the purpose, such as Argon2, bcrypt or scrypt.

How do I verify a downloaded file?

Drop the file into the tool and paste the checksum published by the download site into the Verify box. If any algorithm matches, it's highlighted and the file is intact.