Hash Generator

Runs in your browserDeveloper Tools#Security#Crypto

Get MD5, SHA-1, SHA-256 and SHA-512 hashes of text or files, and verify file checksums.

Text to hash

0 bytes (UTF-8). Spaces and line breaks count: a trailing newline changes every hash.

HMAC with a secret keySigns the text with a key, as APIs and webhooks do (HMAC-SHA-256 and others).

Type or paste text above to see its MD5, SHA-1, SHA-256, SHA-384 and SHA-512 hashes.

Compare with expected hash (optional)

Paste the checksum from the download page. Case and spaces don't matter.

MD5 and SHA-1 are fine for checksums but not for security: never use them (or any fast hash) to store passwords. Use bcrypt for passwords.

How to use, limits & privacy

About Hash Generator

Get the MD5, SHA-1, SHA-256, SHA-384 and SHA-512 hashes of text or of any file, and check a download against the checksum its publisher lists. Text hashes update as you type and can be HMACs with a secret key. Files of any size are hashed on your device in the background with a progress bar, and are never uploaded. Output can be lowercase hex, uppercase hex or Base64.

How to Use

Choose Text or File

Text hashes what you type or paste. File hashes a file you drop or choose, such as an ISO, installer or PDF.

Add your text or file

Type in the box (or click Example), or drop a file on the File tab. All five hashes appear in one list; a file shows a progress bar while it is read.

Compare with the expected hash

Paste the checksum from the download page into "Compare with expected hash". The tool says Match or No match and highlights the algorithm that matched.

Copy what you need

Pick hex, HEX or Base64 under Output, then click the copy button next to a hash. For an HMAC, turn on "HMAC with a secret key" and enter the key.

Privacy & Processing

Mode: local
Files Leave Browser: Local tool processing; review details below
Max Input Size: Device memory limits
Account Required: No
Data Stored Locally: Nothing is saved; text, keys and file results are cleared when you close the page.
Network Processing: Assets or models may require an initial download

Text and files are hashed in your browser. Nothing is uploaded or sent to any server.

Rules & Limitations

Text is hashed exactly as UTF-8: a space or a trailing newline changes every hash. The byte count under the box helps you check.
Files of any size work. Up to 512 MB they are hashed in a few seconds (about 8 s for 400 MB on a laptop); larger files are read in pieces at roughly 20 MB per second on a laptop, slower on phones.
MD5 and SHA-1 are fine for checksums but broken for security. Never use them, or any fast hash, to store passwords; use bcrypt instead.
HMAC is available for text only. The key is read as UTF-8 text.

Top Suggestions

Verifying the SHA-256 checksum of a Windows or Linux ISO, app installer or firmware
Checking that two copies of a file are identical without opening them
Creating or debugging an HMAC-SHA-256 signature for a webhook or API
Generating MD5 or SHA hashes of strings for tests and database work
Getting a Base64 SHA-384 hash for a script integrity attribute

Hash Generator FAQ

How do I verify a file's SHA-256 checksum?

Open the File tab and drop the file. Paste the SHA-256 value from the download page into "Compare with expected hash". If it says Match, the file is exactly what the publisher released; No match means the download is incomplete, damaged or a different file.

How do I generate an MD5 or SHA-256 hash of text?

Type or paste the text on the Text tab. MD5, SHA-1, SHA-256, SHA-384 and SHA-512 appear at once and update as you type. Remember that spaces and line breaks are part of the text.

Is my file uploaded to calculate the hash?

No. The file is read and hashed in your browser, in a background worker, so it never leaves your device. That is why large files take a little time instead of an upload.

Which is better, MD5, SHA-1 or SHA-256?

For checking downloads, use whatever the publisher lists, most often SHA-256. MD5 and SHA-1 still detect accidental damage but can be forged on purpose, so they are not safe for security. SHA-256 and SHA-512 are the safe choices today.

Can I use this to hash passwords?

No. MD5 and the SHA family are designed to be fast, which makes stored password hashes easy to crack. Passwords need a slow hash such as bcrypt, which you can try in the Bcrypt Hash Generator.

What is an HMAC?

An HMAC is a hash mixed with a secret key. Services such as payment gateways and webhooks sign messages this way so the receiver can tell the message came from someone who knows the key. Turn on "HMAC with a secret key" on the Text tab to compute one.