My Tool Studio
Developer

Hash Generator

This hash generator computes MD5, SHA-1, SHA-256, SHA-384, SHA-512, SHA3-256, SHA3-512 and CRC32 checksums of text or files in your browser. Hashes update as you type, and the Files tab hashes one or many files up to 200 MB each. Tick HMAC with a secret key to get keyed hashes for webhook and API signatures. Choose hex, uppercase hex, Base64 or Base64URL output, read text or keys as UTF-8, hex or Base64, and switch off algorithms you do not need. Paste an expected value into the compare box to see which algorithm and file match. For many files, download a sha256sum-style checksum list or a CSV. Nothing is uploaded.

Always freeNo sign upRuns in your browser
Algorithms

How to use

01

Enter text or choose files

On the Text tab, type or paste and the hashes update as you type; set Input is to hex or Base64 for raw bytes. On the Files tab, drop one or more files up to 200 MB each.

02

Pick algorithms, output and HMAC

Tick the algorithms you want and choose the Output format. Tick HMAC with a secret key and enter the key to get HMAC values instead of plain hashes.

03

Compare, copy or export

Paste a checksum into Compare with an expected hash and the matching line turns green. Copy any value, or for files download a checksum file or a CSV of every hash.

Why Hash Generator

Hash algorithm quick reference

Every algorithm turns any input into a fixed-length output, shown here as hexadecimal. Longer outputs are harder to collide by chance, but the main difference that matters today is whether practical attacks exist.

For new work, pick SHA-256 unless a spec asks for something else. Use MD5 or SHA-1 only to match a checksum someone else published, or where a legacy system gives you no choice. None of these are suitable for storing passwords on their own.

AlgorithmOutput bitsHex charactersSecurity status
MD512832Broken; fine for spotting accidental corruption only
SHA-116040Collisions shown in practice in 2017; avoid for new security uses
SHA-25625664Secure; the common default
SHA-38438496Secure; a shortened form of SHA-512
SHA-512512128Secure; often faster than SHA-256 in software on 64-bit CPUs
SHA3-25625664Secure; a different design from SHA-2, used as a backup standard
SHA3-512512128Secure
CRC32328Not a security hash; detects accidental errors only

How to verify a download checksum

A checksum proves the file you downloaded is byte-for-byte the file the publisher released. Find the SHA-256 value on the official download page, then compute the hash of your copy and compare. With this page, drop the file on the Files tab and paste the published value into the compare box.

If the values match, the file is intact. If they differ, download it again, ideally from the official site rather than a mirror, and never run an installer whose checksum does not match. You can also check from a terminal with tools that ship with your operating system:

  • Windows Command Prompt or PowerShell: certutil -hashfile file.iso SHA256
  • Windows PowerShell: Get-FileHash file.iso (uses SHA-256 by default)
  • macOS: shasum -a 256 file.iso
  • Linux: sha256sum file.iso
  • MD5 on macOS: md5 file.iso, and on Linux: md5sum file.iso

Worked example: one extra newline changes everything

Hashes change completely when a single byte changes. The text hello world gives the SHA-256 hash b94d27b9934d3e08a52e52d7da7dabfac484efe37a5380ee9088f7ace2efcde9 and the MD5 hash 5eb63bbbe01eeed093cb22bb8f5acdc3.

Add one newline at the end, which is what echo hello world does in a terminal, and SHA-256 becomes a948904f2f0f479b8f8197694b30184b0d2ed1c1cd2a1ec0fb85d299a192a447 while MD5 becomes 6f5902ac237024bdd0c176cb93063dc4. Nothing in the new hashes hints that the inputs were almost the same.

This is the most common reason a hash from this page does not match one from a script. Use echo -n, or printf, when you hash text on the command line, and check for Windows line endings when you hash files that were edited on different systems. Pasting the text into the box on this page and comparing it with your script's output quickly shows whether the input is the problem.

Common questions

Can a hash be reversed or decrypted?
No. A hash is a one-way function, so there is no key that turns it back into the input. Sites that claim to decrypt MD5 or SHA-1 look the hash up in huge tables of common passwords and phrases, which only works for short or common inputs.
What is the difference between hashing and encryption?
Encryption is reversible with a key and keeps data secret. Hashing is one-way and produces a fixed-length fingerprint, used to check integrity or to store password verifiers. This tool only hashes; it cannot encrypt or decrypt anything.
Which hash should I use for file checksums?
SHA-256 is the usual choice and is what most download pages publish. MD5 and SHA-1 still catch accidental corruption, but they cannot be trusted against deliberate tampering, because collisions can be created on purpose. Use whichever algorithm the publisher lists so you can compare.
Why do I get a different hash than my code?
The bytes differ. Common causes are a trailing newline (echo adds one unless you use echo -n), Windows CRLF line endings, a text encoding other than UTF-8, or spaces at the start or end. The text box hashes the exact UTF-8 text unless Input is set to hex or Base64, and the Files tab hashes the raw bytes of each file.
Why is MD5 labelled as not for security?
Researchers have been able to create two different inputs with the same MD5 hash since 2004, and practical attacks followed. That makes MD5 unsafe for signatures, certificates and passwords. It is still widely used as a quick checksum for accidental changes, which is why it is included.
How long is a SHA-256 hash?
Always 64 hexadecimal characters, which is 256 bits. MD5 gives 32 characters, SHA-1 gives 40, SHA-384 gives 96, SHA-512 gives 128, SHA3-256 and SHA3-512 give 64 and 128, and CRC32 gives 8, however long the input is. Base64 output is shorter for the same bytes.
Is SHA-256 suitable for storing passwords?
No. Password storage needs a salted, deliberately slow algorithm such as bcrypt, scrypt or Argon2, which makes guessing expensive. General-purpose hashes are built to be fast, which is the opposite of what you want there.
Can this hash generator handle large files?
Yes, up to 200 MB per file, and you can add several files at once. Each file is read into memory, so very large files can be slow on phones or older computers. For bigger files, use the command-line tools described below.
Does this hash tool support HMAC or SHA-3?
Yes to both. SHA3-256 and SHA3-512 are listed with the other algorithms, and ticking HMAC with a secret key turns every algorithm except CRC32 into its HMAC version. For a page built around signing and verifying webhook payloads, use the HMAC Generator.
What is CRC32 and when should I use it?
CRC32 is a fast 32-bit checksum used inside ZIP, PNG and gzip files to catch accidental corruption. It is easy to forge, so never use it for security. Use it when a format or tool asks for a CRC32 value, and SHA-256 for anything else.

More Developer tools

View all

JSON Formatter

Beautify, minify and browse JSON as a tree

Developer

JSON Validator

Find JSON errors by line and fix them

Developer

JSON Minifier

Minify JSON and see the bytes saved

Developer

JSON to CSV Converter

Convert JSON arrays to CSV or Excel

Developer