How to generate a hash
- Type or paste text, or switch to File and drop any file. MD5, SHA-1, SHA-256, SHA-384, SHA-512 and CRC32 are calculated at once and update as you type.
- Tick HMAC and enter a key to compute keyed hashes (HMAC-SHA256 and others) for API signatures and webhooks.
- Choose hex or Base64 output and upper or lower case, then copy the value you need.
- To check a download, paste the publisher's checksum into Compare. The tool tells you whether it matches and which algorithm it is.
What is a hash function?
A cryptographic hash turns any amount of data into a short fixed-length fingerprint. The same input always gives the same hash, and changing a single bit changes the result completely. Hashes are used to verify downloads, detect duplicate files, index data and sign messages.
MD5 and SHA-1 are fast and still fine for checksums and cache keys, but they are broken for security: attackers can create two different files with the same hash. Use SHA-256 or SHA-512 for anything security-related. CRC32 is not cryptographic at all; it detects accidental corruption in ZIP files and network packets.
None of these should be used on their own to store passwords. Use a slow, salted algorithm such as bcrypt, scrypt or Argon2 instead.
Privacy
SHA hashes use the browser's Web Crypto API and MD5 and CRC32 run in plain JavaScript on this page. Your text and files never leave your device, so you can safely hash private documents and keys.
Is the hash of text the same as in other tools?
Yes, as long as the bytes are identical. Text is encoded as UTF-8. Watch out for trailing newlines: echo in a terminal adds one unless you use echo -n.
Can a hash be reversed?
No. Hashes are one-way. Short or common inputs can be found by guessing, which is why lookup sites can "decrypt" weak MD5 hashes of simple passwords.
What is HMAC used for?
HMAC combines a secret key with the hash so only someone with the key can produce the right value. Stripe, GitHub and Slack webhooks use HMAC-SHA256 signatures this way.
How big a file can I hash?
Files of several hundred megabytes work on most devices, because the whole file is read into memory and hashed locally.