What is hashing?
A hash function turns any input into a short, fixed-length digest, and the same input always gives the same digest. This tool computes the MD5, SHA-1, SHA-256, SHA-384, and SHA-512 digests of text or of a file at once, in your browser. It can also check them against a hash you paste, and compute HMACs with a key. Files are read in chunks in a background worker, so a file of any size can be hashed.
What a hash function does
A hash function turns any input, from a single word to a multi-gigabyte file, into a digest of fixed length: 128 bits for MD5, 256 bits for SHA-256. A digest is bytes, usually written in hexadecimal (two characters per byte, so 64 characters for SHA-256) or in Base64. The same input always gives the same digest, and there is no way to run the function backwards to recover the input.
A change anywhere in the input changes the whole digest: the SHA-256 of hello starts 2cf24dba, and of Hello, 185f8db3. That's what makes hashes useful for checking that a file or message hasn't changed, fingerprinting content, and finding duplicates.
Choosing an algorithm
SHA-256 is the usual choice today, and the checksum many download pages publish. SHA-384 and SHA-512 belong to the same SHA-2 family with longer digests; SHA-384 is the common choice for HTML integrity attributes.
MD5 and SHA-1 are broken for security: collisions, two different inputs with the same digest, can be made on purpose, as the SHAttered attack showed for SHA-1 in 2017, and NIST is retiring SHA-1 by the end of 2030. They still catch accidental corruption, such as a download that only lists an MD5 checksum, but never use them where someone might forge an input.
None of these is right for storing passwords. They are built to be fast, which makes guessing fast too. Store passwords with a slow, salted password hash such as Argon2id, scrypt, or bcrypt.
Text, line endings, and trailing newlines
A hash covers exact bytes, so two texts that look the same can hash differently. Text here is encoded as UTF-8, the encoding almost every system uses, before it's hashed.
Line breaks are the usual cause of a mismatch. Text files on Windows end lines with CRLF (\r\n), and on macOS and Linux with LF (\n). A text box can't keep the line endings it was given, so choose them with the Line endings setting, or choose the file itself to hash its bytes exactly.
The command line has one more trap: echo hello | sha256sum hashes hello followed by a newline, so it prints 5891b5b5…6be03 rather than the 2cf24dba…9824 of hello alone. printf '%s' hello | sha256sum hashes the text without the newline.
Verifying a download with a checksum
Download pages often list a checksum for each file. Choose the downloaded file here, then paste the published value into Verify. The tool tells the algorithm from the length of the value, accepts hex in either case or Base64, and reads lines copied from checksum files such as SHA256SUMS. A match means the file you have is byte for byte the one that was published.
A checksum only proves the file is intact if it comes from a source you trust: anyone who can replace a download can usually replace the checksum on the same page. That's why many projects also sign their checksum files.
HMAC: a hash with a key
An HMAC (RFC 2104) mixes a secret key into the hash, so only someone who has the key can produce or check the value. Stripe signs every webhook request this way, and GitHub does once a webhook secret is set, both with HMAC-SHA-256; the receiver recomputes the value to confirm the request is genuine.
Enter a key in the HMAC key field and every row becomes an HMAC of the input. The key is read as UTF-8 text and never leaves your browser.
Salting and why it matters
The same password always hashes to the same digest, so identical passwords give identical hashes and can be cracked with tables of precomputed hashes. A salt, a unique random value stored with each hash, makes every stored hash different. Argon2id, scrypt, and bcrypt add a salt for you.
How to generate a hash
- 1Enter text or choose a file. Type or paste text, or choose or drop a file. The MD5, SHA-1, SHA-256, SHA-384, and SHA-512 digests appear as you type, or as the file is read.
- 2Set the output. Choose Hex or Base64, the line endings your text should be hashed with, and an HMAC key if you need keyed hashes.
- 3Copy or verify. Copy any digest, or paste a published hash into Verify to check that it matches.
Examples
SHA-256 of a word
Input
hello
Output
2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824
The same word from echo
echo adds a newline, so this is the SHA-256 of hello followed by LF. printf '%s' hello | sha256sum prints the digest above.
Input
echo hello | sha256sum
Output
5891b5b522d5df086d0ff0b110fbd9d21bb4fc7163af34d08286a2e846f6be03 -
MD5 of a word
Not collision-resistant: fine for checksums, not for security.
Input
hello
Output
5d41402abc4b2a76b9719d911017c592
HMAC-SHA-256 with a key
With secret in the HMAC key field.
Input
hello
Output
88aab3ede8d3adf94d26ab90d3bafd4a2083070c3bcce9c014ee04a443847c0b
Integrity value for a script
With Output set to Base64. It goes in the integrity attribute of the script tag that loads the file.
Input
console.log("hello");Output
sha384-ym/3cF/gAcW1/eerNQGFaOSOuU2LHI6RYvChaVur/G+PkVozZ5Zo8Uu5R2S2zm7C
Verifying a line from a checksum file
With hello as the input, the line pasted into Verify.
Input
2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824 hello.txt
Output
Matches the SHA-256 value.
Hash algorithms
Digest sizes, and what each algorithm is used for today.
| Algorithm | Digest size | Use today |
|---|---|---|
| MD5 | 128 bits: 32 hex or 24 Base64 characters | Accidental-corruption checks only; collisions are easy to make |
| SHA-1 | 160 bits: 40 hex or 28 Base64 characters | Legacy checksums; collisions shown in 2017, retired by NIST by 2030 |
| SHA-256 | 256 bits: 64 hex or 44 Base64 characters | Download checksums, Docker image digests, signatures, HMAC |
| SHA-384 | 384 bits: 96 hex or 64 Base64 characters | HTML integrity attributes, TLS |
| SHA-512 | 512 bits: 128 hex or 88 Base64 characters | npm package integrity; used inside Ed25519 signatures |
Frequently asked questions
Can a hash be reversed?
No. Hashing is one-way: a digest can't be turned back into its input. Short or common inputs, such as most passwords, can still be found by guessing, hashing each guess and comparing, which is why passwords need a slow, salted password hash.
Why is MD5 considered insecure?
Because collisions, two different inputs with the same MD5 digest, can be made in seconds on an ordinary computer. That breaks signatures and certificates, which rely on no one being able to make a second input with the same hash. MD5 still catches accidental corruption, so an MD5 checksum is fine for checking that a download arrived intact.
Should I hash passwords with SHA-256?
No. SHA-256 is designed to be fast, so an attacker with a GPU can try billions of guesses a second. Store passwords with a slow, salted password hash such as Argon2id, scrypt, or bcrypt.
Why doesn't my hash match the one from the command line?
Usually because the bytes differ. echo adds a newline (use printf '%s' instead), Windows text files end lines with CRLF where macOS and Linux use LF (set Line endings to match), and some tools hash text in an encoding other than UTF-8. To compare with a file's checksum, choose the file itself, so its exact bytes are hashed.
How do I verify a downloaded file?
Choose the file, then paste the checksum from the download page into Verify. It tells the algorithm from the value's length, accepts hex or Base64, and reads a line copied from a checksum file such as SHA256SUMS. A match means your copy is byte for byte the one that was published.
Is there a file size limit?
No. Files are read in chunks in a background worker, so a file of any size is hashed without being loaded into memory. A large file takes longer, and the progress shows while it's read.
What is an HMAC?
A hash computed with a secret key (RFC 2104), so only someone with the key can produce or check it. Webhooks, API request signing, and signed cookies use HMACs, most often HMAC-SHA-256. Enter a key in the HMAC key field to get HMACs instead of plain hashes.
What is the integrity value?
With Output set to Base64, the SHA-256, SHA-384, and SHA-512 rows also show a value such as sha384-… for the integrity attribute of a script or link tag (Subresource Integrity). The browser refuses to use the file if its hash doesn't match.
Is my input sent to a server?
No. Text and files are hashed in your browser, and files are never uploaded. The only exception is the Share link button: for text, it uploads the text and its hashes; for a file, only its name, size, and hashes. It never includes an HMAC key.
Is it free?
Yes. It's free, with no sign-up and no limits.