Hash Generator (MD5, SHA-1, SHA-256, SHA-384, SHA-512)
Hash text, checksum files, generate HMACs, and verify hashes against expected values — all five algorithms on one page, all computed locally in your browser.
Type or drop something above — hashes appear here instantly.
Private by design: every hash is computed 100% in your browser with the Web Crypto API and local code. Nothing you type or drop is ever uploaded anywhere.
TL;DR
Need a quick hash? Type in the Text tab — all five algorithms compute instantly. Verifying a download? Use File checksum and match it against the publisher’s value in Compare. Signing API requests? HMAC with SHA-256 is the standard choice. Rule of thumb: SHA-256 for everything security-related, MD5 only for casual checksums.
What is a hash function?
A cryptographic hash function takes input of any size and produces a fixed-size digest — MD5 always outputs 32 hex characters, SHA-256 always 64. Good hash functions have three properties: it is infeasible to reverse them (one-way), infeasible to find two inputs with the same output (collision-resistant), and a tiny input change flips about half the output bits (avalanche effect). When the collision-resistance property breaks — as it did for MD5 in 2004 and SHA-1 in 2017 — the algorithm must be retired from security use.
Which algorithm should you pick?
| Algorithm | Output | Status | Use for |
|---|---|---|---|
| MD5 | 128-bit | Broken (2004) | Casual checksums only |
| SHA-1 | 160-bit | Broken (2017) | Legacy verification only |
| SHA-256 | 256-bit | Secure | Default choice, file verification, HMAC |
| SHA-384 | 384-bit | Secure | High-security contexts (TLS uses it) |
| SHA-512 | 512-bit | Secure | Maximum margin, 64-bit platforms |
SHA-256 is the sweet spot for almost everyone: fast, universally supported, and with no practical attacks after 25 years. SHA-384 and SHA-512 buy extra margin at the cost of longer outputs — sensible for certificates and long-lived signatures. There is also SHA-3 (standardized 2015, a different design called Keccak), but SHA-2 remains the world’s workhorse and is what this page computes.
Common uses
Download verification: compare a file’s SHA-256 against the publisher’s checksum to prove it arrived intact. API security: HMAC-SHA-256 signs webhooks so receivers can trust them. Deduplication: identical files have identical hashes, which is how backup tools spot duplicates. Git: every commit is addressed by its SHA-1 hash (migration to SHA-256 underway). What hashes are not for: storing passwords directly — that needs bcrypt, scrypt, or Argon2.
FAQs
A hash is a fixed-length fingerprint of some data: feed in text or a file of any size and you get back a short string (like the 64-character SHA-256 output) that uniquely represents it. Change even one character of the input and the hash changes completely — this avalanche effect is what makes hashes useful for verifying file downloads, storing data fingerprints, and signing API requests.
Use SHA-256. MD5 is cryptographically broken — researchers demonstrated practical collisions in 2004, and chosen-prefix collisions followed in 2008 — so it must never be used where an attacker could benefit. MD5 is still fine for non-security checksums (like spotting accidental download corruption). SHA-256 is the current safe default for file verification, data fingerprinting, and HMAC signatures.
No — not anymore. SHA-1 was standardized in 1995, theoretical attacks appeared in 2005, and Google and CWI Amsterdam demonstrated the first practical collision in 2017 (the SHAttered attack). Migrate anything still on SHA-1 to SHA-256 or SHA-512. Git is the famous holdout and is slowly moving to SHA-256.
HMAC combines a hash with a secret key, so the output proves both integrity and authenticity — only someone with the key could have produced it. APIs use HMAC-SHA-256 to sign webhooks and requests: the server recomputes the HMAC with the shared secret and rejects anything that does not match. A plain hash cannot do this because anyone can recompute it.
Drop the file into the File checksum tab and compare the SHA-256 output with the checksum published by the download source (the Compare tab does this for you). If they match exactly, the file arrived intact and untampered. Software vendors publish SHA-256 checksums for exactly this reason.
More free tools
htpasswd Generator
Client-side • No sign-up
Password Generator
Client-side • No sign-up
Base64 Converter
Client-side • No sign-up
Want guides and tips? Visit the ToolsOfWeb blog or go back to the homepage.