Hash Generator — MD5, SHA-1, SHA-256, SHA-512, CRC32 and HMAC
Hash text or files with MD5, SHA-1, SHA-256, SHA-384, SHA-512 and CRC32, verify a checksum, or compute an HMAC. Files never leave your device.
| MD5 | … | |
|---|---|---|
| SHA-1 | … | |
| SHA-256 | … | |
| SHA-512 | … | |
| CRC32 | … |
Text and files are hashed in your browser; files are read from your disk in chunks and never uploaded. Browse all free tools.
Found a problem, or something that could be better? We read every message and we fix things quickly.
This hash generator computes MD5, SHA-1, SHA-256, SHA-384, SHA-512 and CRC32 checksums for text or files, all at once, in your browser. Use it to check that a download matches the checksum on the publisher's site, to get a SHA-256 for a lockfile or a Subresource Integrity attribute, or to compute an HMAC signature while debugging a webhook. Text is hashed as UTF-8 bytes, the same as sha256sum, OpenSSL and every programming language's standard library.
Files are read from your disk in 4 MB slices and fed to streaming hash functions, so a multi-gigabyte ISO is checked without loading it into memory and without uploading a byte. Progress is shown and you can cancel. One honest limit: hashing in a browser tab is slower than a native tool, so for a 50 GB disk image, sha256sum or certutil on the command line will be faster.
How to use
- Choose Text, File or HMAC at the top.
- For text, type or paste; the hashes update as you type. For a file, drop it on the box or click to choose it.
- Untick algorithms you do not need before hashing a large file; each one adds time.
- Paste the publisher's checksum into "Compare with expected checksum" to get a clear match or mismatch.
- Switch output to Base64 or uppercase hex if the system you are comparing with uses that form, then copy.
Frequently asked questions
What is the difference between MD5, SHA-1 and SHA-256?
They are hash functions with different output sizes and security. MD5 produces 128 bits and SHA-1 160 bits; both are broken for security purposes, because researchers can create two different inputs with the same hash (MD5 since 2004, SHA-1 publicly since the 2017 SHAttered attack). SHA-256 produces 256 bits and has no known practical attack. Use SHA-256 or SHA-512 for anything security-related; MD5 and SHA-1 remain fine for spotting accidental corruption.
How do I verify a file's checksum?
Open the File tab, drop the downloaded file, and paste the checksum from the download page into the comparison field. A match means the file you have is byte-for-byte the one the publisher hashed. Make sure you compare like with like: a SHA-256 checksum is 64 hex characters, SHA-1 is 40 and MD5 is 32. For real assurance, get the checksum over HTTPS from the official site, not from the same mirror as the file.
Can a hash be reversed or decrypted?
No. A hash is a one-way function: there is no key and nothing to decrypt. What "MD5 decrypt" sites actually do is look the hash up in tables of previously hashed common strings. That is why a hash of a short or common password is easy to find, and why passwords must be stored with a slow, salted algorithm such as bcrypt or Argon2, never a plain SHA-256.
Why does my hash not match the one from my code?
The input bytes differ, usually invisibly. The common causes are a trailing newline (echo adds one; use echo -n), Windows CRLF line endings instead of LF, a different text encoding than UTF-8, leading or trailing spaces, or comparing a hex digest with a Base64 one. Hashes change completely on a single-byte difference, so check the byte count shown under the text box.
What is HMAC and when do I need it?
HMAC (RFC 2104) combines a secret key with a hash function to produce a signature that only someone with the key can create. Webhook providers such as Stripe, GitHub and Shopify sign their payloads with HMAC-SHA256 so you can verify a request really came from them. Do not build this yourself as sha256(key + message): with SHA-256 that construction is open to length-extension attacks, which HMAC is designed to prevent.
Is CRC32 a hash?
It is a checksum, not a cryptographic hash. CRC32 is very fast and good at detecting accidental errors such as a flipped bit in transmission, which is why ZIP, gzip, PNG and Ethernet use it. It is trivial to forge deliberately, so never use it to prove a file has not been tampered with.
Which hash to use for what
• Verifying a download against the publisher's checksum: whichever algorithm they published, usually SHA-256.
• Integrity in security-relevant places (Subresource Integrity, package lockfiles, code signing, certificates): SHA-256 or SHA-384. SRI attributes use Base64, which is why the output switch exists.
• Signing an API request or webhook with a shared secret: HMAC-SHA256.
• Storing passwords: none of these. Use bcrypt, scrypt or Argon2id, which are deliberately slow and salted. A fast hash lets an attacker test billions of guesses per second on a GPU.
• Deduplication, cache keys, ETags and detecting accidental corruption: MD5, SHA-1 or CRC32 are fine and fast, because nobody is trying to forge a collision.
How hashing large files works here
The browser's built-in WebCrypto API can only hash a buffer it has in memory all at once. For text that is fine, and this tool uses it. For a 4 GB file it would mean reading 4 GB into the tab, which fails or crashes on most devices.
So files go through streaming implementations of SHA-1, SHA-256, SHA-384, SHA-512 and CRC32 (and spark-md5 for MD5) that consume the file 4 MB at a time, reading each slice directly from disk with File.slice. Memory use stays flat regardless of file size. The implementations are tested byte-for-byte against Node's OpenSSL-backed crypto module on boundary lengths and random data.
On a recent laptop, expect very roughly 150–250 MB per second for MD5, SHA-1 or SHA-256, and about a third of that for SHA-384 and SHA-512, whose 64-bit arithmetic JavaScript has to emulate with 32-bit pieces. All selected algorithms share one pass over the file, so unticking the ones you do not need is the easiest way to speed it up.
Reading a checksum file
Linux distributions and open-source projects publish files such as SHA256SUMS. Each line is the hex digest, two spaces, then the filename, which is the format sha256sum produces. macOS shasum uses the same format; BSD-style tools write SHA256 (file.iso) = digest instead.
You can paste either line style into the comparison field: the tool takes the digest out and ignores the rest, along with case, spaces and colons. When a project also publishes a signature file (SHA256SUMS.gpg or .sig), verifying that signature with the project's key is what proves the checksum list itself was not replaced.
Related free tools
- Bcrypt Generator — Hash a password with bcrypt at the cost you choose, check a password against a bcrypt hash, and see what each part of the hash means.
- Base64 Encoder / Decoder — Encode text or files to Base64, turn images into data URIs with CSS and <img> snippets, and decode Base64 back to a previewable file. Nothing leaves your browser.
- Password Generator — Generate a strong random password, a memorable passphrase or a PIN. Runs entirely in your browser, nothing is sent or stored.
- TOTP Generator — Turn a Base32 secret into live 2FA codes with a countdown, build an otpauth:// QR code for authenticator apps, or read an existing URI.