Hash Generator: MD5, SHA-1, SHA-256, SHA-512

Hash text or a file in your browser, with an optional HMAC key, and check the result against a published checksum.

Choose what to hash

Text to hash

Output format

HMAC secret key (optional)

With a key, the table shows HMAC values instead. The key is read as UTF-8 text.

Algorithm	Hash value	Copy
MD5⚠	`—`
SHA-1⚠	`—`
SHA-256	`—`
SHA-384	`—`
SHA-512	`—`

Check against a published checksum (optional)

Security note: MD5 and SHA-1 are broken for security use, because collisions can be created on purpose. They still catch accidental changes such as a corrupted download. Use SHA-256 or higher where security matters.

How to generate a hash

Type or paste text into Text to hash. The word "hello world" is already there, and all five hashes update as you type. To hash a file instead, open the File tab and drop a file on the box, or press Enter on it to choose one.
Pick the Output format: lowercase hex, uppercase hex or Base64 (the form used in integrity attributes on script tags).
Optional: type a key in HMAC secret key, and the table switches to HMAC values.
To verify a download, paste the published checksum into Check against a published checksum. The matching row turns green and the message names the algorithm. The Compare two hashes tab checks two pasted values against each other.

How it works

Text is first turned into UTF-8 bytes, so "café" gives the same hash as a UTF-8 file containing those letters. SHA-1, SHA-256, SHA-384 and SHA-512 come from your browser's Web Crypto API, which implements FIPS 180-4. MD5 follows RFC 1321 and is calculated by code on this page. HMAC follows RFC 2104. Nothing is uploaded: files are read into memory in your browser.

Worked example

With the default text hello world (11 bytes) and lowercase hex, the table shows:

MD5      5eb63bbbe01eeed093cb22bb8f5acdc3
SHA-1    2aae6c35c94fcfb415dbe95f408b9ce91ee846ed
SHA-256  b94d27b9934d3e08a52e52d7da7dabfac484efe37a5380ee9088f7ace2efcde9
SHA-384  fdbd8e75a67f29f701a4e040385e2e23986303ea10239211af907fcbb83578b3
         e417cb71ce646efd0819dd8c088de1bd
SHA-512  309ecc489c12d6eb4cc40f50c902f2b4d0ed77ee511a7c7a9bcd3ca86d4cd86f
         989dd35bc5ff499670da34255b45b0cfd830e81f605dcf7dc5542e93ae9cd76f

Change one letter to "Hello world" and every digit of every hash changes, which is how a hash exposes a modified file. Paste the SHA-256 line into the checksum box and the SHA-256 row turns green.

Limits and edge cases

Line endings matter. The text box turns pasted line breaks into a single line feed, and echo hello | sha256sum also hashes a trailing newline. To match a file byte for byte, use the File tab.
Files over 1 GB are refused, because the whole file must fit in browser memory. Use sha256sum, shasum or Get-FileHash for those.
Do not store passwords as plain SHA or MD5 hashes. Use a slow password hash such as Argon2id, bcrypt or scrypt, as the OWASP guidance explains.
SHA-3, SHA-224 and CRC32 are not offered.

Frequently asked questions

What is the difference between hashing and encryption?

Hashing is one way: it turns any input into a fixed-length fingerprint that cannot be reversed. Encryption is two way, because the right key turns the scrambled data back into the original.

Is MD5 still safe to use?

Not for security. Collisions can be created deliberately, so MD5 must not protect passwords or signatures. It is still fine for spotting accidental changes, such as a corrupted download.

Which hash algorithm should I use?

Use SHA-256 for checksums and integrity checks. SHA-384 and SHA-512 give longer digests. Avoid MD5 and SHA-1 wherever an attacker could benefit from a collision.

How do I check a file's checksum?

Open the File tab, choose the file, then paste the checksum from the download page into the checksum box. A green "Match" means the file is identical to the one that was published.

Why is my hash different from the one in my terminal?

The usual cause is a trailing newline or different line endings in the text. Another is a different encoding, since this tool hashes UTF-8 bytes. Hash the saved file in the File tab to get the exact bytes.

Sources: NIST FIPS 180-4 (SHA-1 and SHA-2), RFC 1321 (MD5), RFC 2104 (HMAC) and the OWASP Password Storage Cheat Sheet. Related tools: verify a signed token with the JWT decoder, convert a digest with the Base64 encoder and decoder, make a strong password with the password generator, or see where two texts differ with the diff checker.