Hash Generator
MD5, SHA-1, SHA-256, SHA-384 and SHA-512 hashes of text or files, plus HMAC.
Each line is hashed without its line break. Files are read on your device and never uploaded.
How to use Hash Generator
- Choose text or file, then type text or pick a file.
- All five hashes are calculated at once.
- To verify a download, paste the published checksum into Compare; a match is highlighted.
How it works
SHA-1, SHA-256, SHA-384 and SHA-512 are computed with the browser’s Web Crypto API; MD5 is computed by a small built-in implementation of RFC 1321. Text is hashed as UTF-8 bytes, which is what command-line tools such as sha256sum do with a UTF-8 file (watch for a trailing newline: "hello" and "hello\n" hash differently).
MD5 and SHA-1 are broken for security purposes because collisions can be created on purpose. Use them only for checksums against accidental corruption; use SHA-256 or stronger for anything security-related. Passwords should never be stored as plain hashes; use a slow password hash such as Argon2 or bcrypt.
Example
SHA-256 of hello world is b94d27b9934d3e08a52e52d7da7dabfac484efe37a5380ee9088f7ace2efcde9.
Frequently asked questions
Why does my hash differ from the command line?
Usually a trailing newline: echo hello | sha256sum hashes "hello\n". Use echo -n or printf to hash the exact text.
Is my file uploaded to calculate the hash?
No. The file is read by your browser and hashed locally; it never leaves your device.
Which hash should I use?
SHA-256 for integrity and signatures. MD5/SHA-1 only to match legacy checksums.
What is HMAC?
A keyed hash (RFC 2104) that proves a message came from someone holding the key. Enter a key to get HMAC-SHA values.
Limitations
- Files are read fully into memory; files larger than about 1–2 GB may fail in some browsers.
- HMAC is offered for the SHA family only (not MD5).
Last reviewed November 9, 2026. How we build and test tools.