Hash Generator (MD5, SHA-1, SHA-256, SHA-512)

Hash text or a file with MD5, SHA-1, SHA-256, SHA-384, and SHA-512 at once, with optional HMAC and hex or Base64 output.

Runs 100% in your browser

Shortcuts

Copy the output: Alt + Shift + C

Your input is saved in this browser only. Reset clears it.

Output

Text to hash

Use an HMAC key

Hashes

Type some text to see its hashes.

Compare with a known hash

Paste a checksum from a download page to see whether any algorithm above matches it.

How to use the Hash Generator

Type or paste text, or drop in a file.
Optionally add an HMAC key, and choose hex or Base64 output.
Copy the hash you need, or paste a published checksum to see whether it matches.

Example: Hashing a classic test string

Input

The quick brown fox jumps over the lazy dog

Output

MD5:     9e107d9d372bb6826bd81d3542a419d6
SHA-1:   2fd4e1c67a2d28fced849ee1bb76e7391b93eb12
SHA-256: d7a8fbb307d7809469ca9abcb0082e4f8d5651e46d3cdb762d02d0bf37c9e592

Change one character in the input and every digest changes completely. Paste a published checksum into the compare box to see which algorithm it matches.

Frequently Asked Questions

What is a hash function?

A hash function turns any input into a fixed-length value. The same input always produces the same hash, a small change produces a completely different one, and the original data can't be recovered from the hash. That makes hashes useful for verifying that a file or message hasn't changed.

Which hash algorithm should I use?

Use SHA-256 for anything new. MD5 and SHA-1 are broken for security purposes because attackers can construct two inputs with the same hash, so they should only be used for non-security checks such as cache keys or matching a legacy checksum. SHA-384 and SHA-512 are useful when you want a longer digest.

Can I hash a password with this tool?

You can, but you shouldn't store passwords this way. Plain hashes are far too fast, which makes guessing attacks cheap. Password storage needs a slow algorithm designed for it, such as bcrypt, scrypt, or Argon2, with a unique salt per password.

What is an HMAC?

An HMAC combines a hash with a secret key, so only someone holding the key can produce or check the value. It is what webhook providers use to sign payloads: recompute the HMAC of the received body with your signing secret and compare it with the signature header to confirm the request is genuine.

About hashing

A hash function maps any input to a fixed-length value. The same input always gives the same hash, changing a single byte changes the output completely, and there's no way back to the original data. Hashing isn't encryption (nothing can be decrypted) and it isn't encoding (Base64 is reversible on purpose); it's a fingerprint you can compare.

Which algorithm, and when

Algorithm	Length	Use it for
MD5	128 bits	Legacy checksums and cache keys only. Collisions are easy to construct, so never for security.
SHA-1	160 bits	Old systems such as Git object ids. Broken for security since 2017; don't choose it for anything new.
SHA-256	256 bits	The default. File checksums, signatures, HMACs, content addressing.
SHA-384 / SHA-512	384 / 512 bits	Where a longer digest is required, and often faster than SHA-256 on 64-bit hardware.

Verifying a download

Projects publish a checksum so you can confirm a file arrived intact and unmodified. Drop the file into the File tab here, or hash it locally, then compare with the published value. Paste the published checksum into the compare box and the matching row is highlighted.

shasum -a 256 installer.dmg # macOS

sha256sum installer.iso # Linux

Get-FileHash .\installer.exe # PowerShell

HMAC and webhook signatures

An HMAC mixes a secret key into the hash, so only someone with the key can produce or check it. That's how webhook providers sign requests: they send a header containing an HMAC of the request body, and you recompute it with your signing secret and compare. If the values differ, the request didn't come from them. Compare with a constant-time function in production code so timing doesn't leak the expected value.

Don't hash passwords with these

General-purpose hashes are built to be fast, which is exactly wrong for passwords: modern hardware tries billions of guesses per second. Store passwords with a slow, salted algorithm designed for the job, such as bcrypt, scrypt, or Argon2.