All Tools

Hash Generator

Calculate MD5, SHA-1, SHA-256, SHA-384 and SHA-512 hashes of any text or file at once, create HMACs with a secret key, and check a download against its published checksum.

Runs in your browser — nothing is uploaded Free, no limits

Text to hash

0 bytes · updates as you type
Paste a published checksum — hex is matched case-insensitively, spaces are ignored.

Hashes

MD5not for security
—
SHA-1not for security
—
SHA-256
—
SHA-384
—
SHA-512
—
MD5 and SHA-1 are broken for security. Collisions can be crafted, so don't use them for signatures, certificates or password storage. They're still fine for checksums and detecting accidental corruption. For passwords use a slow hash such as Argon2, bcrypt or scrypt.

How to use the Hash Generator

  1. Type or paste text — or switch to File and pick a file from your device.
  2. All five hashes appear instantly; choose hex, upper-case HEX or Base64 output.
  3. Tick HMAC and enter a secret key to get keyed HMAC values instead.
  4. Paste an expected checksum into the compare box to confirm the hashes match.

Frequently asked questions

What is a hash function?

A cryptographic hash turns any input into a fixed-length fingerprint. The same input always gives the same hash, a tiny change gives a completely different one, and you can't work backwards from the hash to the input.

Which hash algorithm should I use?

Use SHA-256 (or SHA-512) for anything security-related, such as file integrity, signatures and API request signing. MD5 and SHA-1 are only suitable for non-security checksums because practical collision attacks exist for both.

What is HMAC?

HMAC combines a hash with a secret key, so only someone who knows the key can produce or verify the value. It's widely used to sign API requests and webhooks (for example HMAC-SHA256).

Can I hash passwords with this?

You can compute their hashes, but plain MD5 or SHA hashes are not safe for storing passwords — they are far too fast to brute-force. Store passwords with a slow, salted algorithm such as Argon2id, bcrypt or scrypt.

Why doesn't my hash match the one I got elsewhere?

Hashes depend on the exact bytes. A trailing newline, a different text encoding (this tool uses UTF-8), Windows vs Unix line endings or extra spaces all produce a different hash.

Are my text and files uploaded?

No. Hashing runs entirely in your browser using the Web Crypto API (and a built-in MD5 implementation). Nothing you enter or select leaves your device.