Hash Generator

2026-10-17

Calculate MD5, SHA-1, SHA-256, SHA-384 and SHA-512 hashes of text or of a file on your own computer, compare the result with a published checksum, and create an HMAC with a secret key. Everything runs in your browser; nothing is uploaded.

How to use the hash generator

1. Pick Text or File. For text, type or paste into the box; the hashes update as you type. The text is converted to UTF-8 bytes first, and the line under the box shows how many bytes that is.
2. For a file, press the file button or drop the file anywhere on the page. A progress bar shows how much has been read.
3. Choose the output format: lowercase hex (the usual one), uppercase hex, or Base64. Press Copy next to a hash to put it on the clipboard.
4. To verify a download, paste the checksum published by its author into Compare with an expected checksum. The page tells you whether it matches one of the five hashes and marks the matching row.
5. For a keyed hash, use the HMAC box: enter a key and a message and pick SHA-256, SHA-384 or SHA-512.

What a hash is and how this tool computes it

A hash function turns data of any length into a short, fixed-length fingerprint called a digest. The same input always gives the same digest, a different input gives a completely different one, and the process cannot be run backwards. Change a single letter and roughly half of the output bits flip. The digest sizes are 128 bits for MD5 (32 hex characters), 160 for SHA-1 (40), 256 for SHA-256 (64), 384 for SHA-384 (96) and 512 for SHA-512 (128). In Base64 they take 24, 28, 44, 64 and 88 characters.

The SHA-1, SHA-256, SHA-384 and SHA-512 values come from the browser's built-in Web Crypto function crypto.subtle.digest. It is available only on secure pages (https or localhost). Web Crypto has no MD5, so this page contains its own MD5 implementation, which is checked against the standard test vectors.

Files are read in 4 MiB pieces. MD5 can be updated piece by piece, so it works on files of any size. Web Crypto cannot hash in pieces: it needs all the data at once. That is why SHA hashes are calculated only for files up to 256 MiB, which are held in memory while they are hashed. A larger file still gets its MD5, and the page says why the SHA rows are skipped.

Examples

Example 1 — a short word. The text abc (3 bytes) gives MD5 900150983cd24fb0d6963f7d28e17f72, SHA-1 a9993e364706816aba3e25717850c26c9cd0d89d and SHA-256 ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad. In Base64 the SHA-256 value reads ungWv48Bz+pBQUDeXa4iI7ADYaOWF3qctBD/YfIAFa0=.

Example 2 — one letter changes everything. The sentence The quick brown fox jumps over the lazy dog has MD5 9e107d9d372bb6826bd81d3542a419d6. Replace dog with cog and the MD5 becomes 1055d3e698d289f2af8663725127bd4b: nothing in the new value resembles the old one.

Example 3 — accents and UTF-8. Žltý kôň has 8 characters but 12 bytes in UTF-8, because Ž, ý, ô and ň take two bytes each. Its SHA-256 is 637344c2ca74ab6004cb3dc3398c7efbb676219370648590126cd967ecc7a1d5 and its MD5 is ecc35622b6252f75ae444420c78eaf2b.

Example 4 — HMAC. With the key key and the fox sentence as the message, HMAC-SHA-256 is f7bc83f430538424b13298e6aa6fb143ef4d59a14946175997479dbc2d1a3cd8. It differs from a plain SHA-256 of the message, so the compare box will not match it.

Example 5 — the empty input. Empty text and an empty file both give MD5 d41d8cd98f00b204e9800998ecf8427e. If you see this value for a file that should not be empty, the download or the copy failed.

Which algorithm should I use?

For anything where an attacker could matter, use SHA-256 or stronger. MD5 and SHA-1 are broken for security. Researchers can produce two different inputs with the same MD5 digest on an ordinary computer, and the first public SHA-1 collision was announced in 2017. That means a person who prepares both files in advance can make them look identical to these hashes, so neither should be used for signatures, certificates or proving that a file was not tampered with by someone who can choose its content.

For a different job they are still fine: detecting accidental damage. If a download was cut short or a bit flipped, MD5 and SHA-1 notice it just as well as SHA-256. Use them to compare copies of a file you trust or to find duplicates, and use SHA-256 or SHA-512 when the checksum has to resist deliberate forgery.

None of these is suitable on its own for storing passwords: they are fast, so an attacker can try billions of guesses per second. Use a deliberately slow, salted scheme such as Argon2, scrypt, bcrypt or PBKDF2.

Checking a download, and why hashes differ

Software authors often publish a SHA-256 value next to a download. Hash the file you received, paste the published value into the compare box and look for the match. A match means your copy is bit-for-bit what the author hashed. A checksum on the same page as a tampered file proves little, so prefer one obtained through a separate channel.

When two hashes of the “same” thing differ, the usual causes are:

• a trailing newline or space, which is part of the data (many command-line examples add a newline that you did not type);
• different line endings: the text box always uses \n, so text from a file with \r\n line breaks should be hashed as a file instead;
• a different text encoding;
• a truncated or modified file, or hashing the archive instead of the file inside it.

What HMAC adds

HMAC is a hash combined with a secret key, so only someone who knows the key can produce or check the value. It is defined as HMAC(K, m) = H((K' ⊕ opad) || H((K' ⊕ ipad) || m)), where H is the hash function, m the message, K' the key padded with zero bytes to the block size (64 bytes for SHA-256, 128 bytes for SHA-384 and SHA-512; a longer key is hashed first), ipad is the byte 0x36 repeated, opad is 0x5c repeated, and || means concatenation. HMACs are used to sign webhook calls and API requests. The browser does not accept an empty key, so the page asks for one.

Frequently asked questions

Can a hash be reversed to get the original text?

No. A hash discards information, so many inputs share each digest.

Is MD5 or SHA-1 safe to use?

They are safe for catching accidental corruption and for matching copies of a file, and not safe where someone might attack the result on purpose. For those cases pick SHA-256 or SHA-512.

Why are the SHA hashes of my large file missing?

The browser's crypto function cannot process a file in pieces, so the page has to hold the whole file in memory, and it does this only up to 256 MiB. Above that you still get the MD5, and a command-line tool such as sha256sum on Linux, or the built-in checksum command of your system, can do the rest.

Why does the compare box say “no match” for a value that looks right?

Check that it is the right algorithm, that no characters are missing, and that you pasted the hash and not the file name. The message names the algorithm your value’s length fits.

Is my text or file uploaded anywhere?

No. Every hash is calculated by JavaScript running in your browser, and the page sends no data to a server. The HMAC key is not saved.

For security-critical work, verify results with a second implementation and obtain checksums from a trusted source.

Related tools

• JSON Formatter — validate and pretty-print JSON.
• Regex Tester — test patterns on sample text.
• Word Counter — count the words and characters of a text.
• Two's Complement Calculator — see how numbers are stored as bits.
• Subnet Calculator — work out network ranges and masks.
• CSV to JSON Converter — convert tabular data into JSON.