Hash Generator: MD5, SHA-256, SHA-512 & Checksums
Get the MD5, SHA-1, SHA-256, SHA-384, SHA-512 and CRC32 hash of any text or file at once, create an HMAC with a secret key, or check a download against its published checksum. Everything runs in your browser.
How to use this hash generator
- Text: type or paste text. All six hashes appear at once and update as you type. The text is hashed as UTF-8, like
echo -n "text" | sha256sum. Choose Hex bytes or Base64 under Input is if your data is binary written as hex or Base64. - File: click File, then choose or drop a file. It is read and hashed on your device, never uploaded. Large files show a progress bar.
- Check a download: paste the checksum from the download page into Compare with an expected hash. The matching algorithm turns green. Upper or lower case, spaces and a file name after the hash (the
sha256sumformat) do not matter. - HMAC: tick HMAC with a secret key and enter the key to get HMAC-MD5, HMAC-SHA1, HMAC-SHA256 and the others, for example to test a webhook signature.
- Output: choose lower-case hex (the usual form), upper-case hex or Base64 (used by Subresource Integrity and many APIs). Copy all copies every line with its name.
What is a hash?
A cryptographic hash function turns any input into a short fingerprint of fixed length. It has three properties: the same input always gives the same hash; a change of a single bit gives a completely different hash; and you cannot get the input back from the hash. That is why hashes are used to check that a file was not changed, to find duplicate files, to build IDs and cache keys, and inside digital signatures.
Here is the word hello and the same word with a capital H:
| Input | SHA-256 |
|---|---|
hello | 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824 |
Hello | 185f8db32271fe25f561a6fc938b2e264306ec304eda518007d1764826381969 |
One letter changed, and nothing in the result looks alike. This is called the avalanche effect.
MD5, SHA-1, SHA-256, SHA-512 and CRC32 compared
| Algorithm | Length | Safe against attacks? | Typical use today |
|---|---|---|---|
| MD5 | 128 bit · 32 hex | No (collisions since 2004) | Old checksums, cache keys, de-duplication |
| SHA-1 | 160 bit · 40 hex | No (collisions since 2017) | Git object IDs, old systems |
| SHA-256 | 256 bit · 64 hex | Yes | Download checksums, TLS certificates, Bitcoin, JWT HS256, code signing |
| SHA-384 | 384 bit · 96 hex | Yes | TLS, Subresource Integrity (sha384-…) |
| SHA-512 | 512 bit · 128 hex | Yes | Linux password files (inside sha512-crypt), large integrity checks |
| CRC32 | 32 bit · 8 hex | No, not a security hash | ZIP, PNG and Ethernet: catches accidental damage only |
A collision means two different inputs with the same hash. For MD5 and SHA-1 people can create them on purpose, so an attacker could swap a file without changing its hash. They still catch accidental damage, but for anything security related use SHA-256 or SHA-512.
Passwords: do not store passwords as plain MD5 or SHA-256, even with a salt. These hashes are made to be fast, so attackers can try billions of guesses a second. Use a slow password hash such as Argon2, bcrypt or scrypt.
Check a file checksum on the command line
| System | SHA-256 | MD5 |
|---|---|---|
| Windows (PowerShell) | Get-FileHash file.iso | Get-FileHash file.iso -Algorithm MD5 |
| Windows (cmd) | certutil -hashfile file.iso SHA256 | certutil -hashfile file.iso MD5 |
| macOS | shasum -a 256 file.iso | md5 file.iso |
| Linux | sha256sum file.iso | md5sum file.iso |
| Linux (check a list) | sha256sum -c SHA256SUMS | md5sum -c MD5SUMS |
Windows prints the hash in upper case and Linux in lower case. Both are the same value. For text, use echo -n: plain echo adds a line break, which changes the hash.
Hashing in code
| Language | SHA-256 of a string (hex) |
|---|---|
| JavaScript (browser) | [...new Uint8Array(await crypto.subtle.digest('SHA-256', new TextEncoder().encode(s)))].map(b => b.toString(16).padStart(2, '0')).join('') |
| Node.js | require('crypto').createHash('sha256').update(s).digest('hex') |
| Python | hashlib.sha256(s.encode()).hexdigest() |
| Java | HexFormat.of().formatHex(MessageDigest.getInstance("SHA-256").digest(s.getBytes(UTF_8))) |
| C# | Convert.ToHexString(SHA256.HashData(Encoding.UTF8.GetBytes(s))).ToLower() |
| PHP | hash('sha256', $s) |
| Go | fmt.Sprintf("%x", sha256.Sum256([]byte(s))) |
| HMAC (Node.js) | crypto.createHmac('sha256', key).update(s).digest('hex') |
All of these hash the UTF-8 bytes of the string, so they give the same result as this page.
Frequently asked questions
What is a hash?
A hash is a short fixed-length fingerprint of some data. The same input always gives the same hash, a tiny change in the input gives a completely different hash, and you cannot turn the hash back into the input. SHA-256 always gives 64 hex characters, whether the input is one letter or a 4 GB file.
Which hash should I use?
Use SHA-256 for almost everything: checksums, signatures, IDs and integrity checks. SHA-512 is just as safe and is faster on 64-bit computers. Use MD5 or SHA-1 only when a system asks for them, for example to compare with an old published checksum. CRC32 only catches accidental damage. None of these is right for storing passwords: use bcrypt, scrypt or Argon2 for that.
How do I check the SHA-256 checksum of a download?
Open the File tab, choose the downloaded file and paste the checksum from the download page into the Compare box. The tool hashes the file in your browser and tells you which algorithm matches. If nothing matches, the file is damaged or not the original, so download it again from the official site.
Why is my hash different from another tool?
Almost always the input is different by an invisible character. echo "text" adds a line break at the end, so use echo -n. Windows files may have CRLF line breaks instead of LF. Text can also be in another encoding than UTF-8, or have a space at the end. Hash the exact same bytes and the result is the same everywhere.
Can a hash be decrypted or reversed?
No. A hash is not encryption and there is no key. Sites that claim to decrypt MD5 or SHA-1 look the hash up in large lists of hashes of common words and passwords, so they only find short or common inputs. That is also why fast hashes must never be used alone to store passwords.
What is an HMAC?
An HMAC is a hash mixed with a secret key. Only someone who knows the key can produce the same value, so it proves that a message comes from a key holder and was not changed. Webhooks (GitHub, Stripe, Slack), API request signing and JWT HS256 tokens use HMAC-SHA256.
Are my files uploaded?
No. Text and files are hashed in your browser with the Web Crypto API and JavaScript. Nothing is uploaded or stored, so it is safe for private files, keys and passwords. The page also works offline once it has loaded.