Hash generator: MD5, SHA-256, HMAC
Type text or drop a file to get its MD5, SHA-1, SHA-256, SHA-384, SHA-512 and CRC-32 at once. Add a key for HMAC, or paste a published checksum to verify a download. Files are hashed in your browser and never uploaded.
Drop a file here
Up to 256 MB. It is read and hashed on your device, never uploaded.
How to hash text or a file
- Type or paste text, or switch to File and drop a file. Every hash appears at once: MD5, SHA-1, SHA-256, SHA-384, SHA-512 and CRC-32.
- Pick the format: lowercase hex (what
sha256sumprints), uppercase hex, or Base64 (used in Subresource Integrity and many APIs). - Verify a download by pasting the checksum from the publisher's site. The matching algorithm is highlighted, or you're told that nothing matches.
Which hash should I use?
- SHA-256 is the default choice for checksums, signatures, content addressing and integrity checks. SHA-512 and SHA-384 are its bigger siblings.
- MD5 and SHA-1 are broken for security: attackers can create different files with the same hash. They are still fine for spotting accidental corruption, cache keys and legacy systems.
- CRC-32 is a fast checksum for detecting transmission errors (zip, gzip, PNG, Ethernet). It is not a cryptographic hash.
- For passwords, never use a plain or fast hash. Use a slow, salted password hash like bcrypt, scrypt or Argon2.
HMAC
An HMAC (hash-based message authentication code) mixes a secret key into the hash, so only someone with the key can produce or check it. Webhooks from GitHub, Stripe, Slack and Shopify sign their payloads with HMAC-SHA256: turn on HMAC with a key, paste the raw request body and your signing secret, and compare the result with the signature header to debug a failing webhook. Keys can be text or hex.
Hashes in code and on the command line
- Shell:
sha256sum file(Linux),shasum -a 256 file(macOS),Get-FileHash file(PowerShell),md5sum file. Useprintf %s "text" | sha256sum;echoadds a newline that changes the hash. - JavaScript:
crypto.subtle.digest("SHA-256", new TextEncoder().encode(text)) - Python:
hashlib.sha256(text.encode()).hexdigest(),hmac.new(key, msg, "sha256").hexdigest() - Node.js:
crypto.createHash("sha256").update(text).digest("hex")
Questions
Is my file uploaded?
No. Files are read and hashed in your browser with WebCrypto (and a built-in MD5 and CRC-32), so even large or private files never leave your device.
Why is my hash different from the command line?
Usually a trailing newline: echo "text" | sha256sum hashes the text plus a line break. Use printf %s "text" instead. Also check that both sides use the same encoding (this tool uses UTF-8) and the same output format (hex vs Base64).
Can a hash be reversed?
No. Hashes are one-way. But short or common inputs can be found by guessing, which is why passwords need a slow, salted password hash rather than MD5 or SHA-256.
Is MD5 still safe?
Not for security. MD5 collisions can be made in seconds, so it must not be used for signatures or passwords. It is still fine for detecting accidental corruption and as a cache key.
What is the SHA-256 of an empty string?
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855. Clear the text box to see the hash of empty input for every algorithm.
How do I verify a GitHub or Stripe webhook signature?
Turn on HMAC, paste the exact raw request body as text and your webhook secret as the key, and compare HMAC-SHA256 with the signature header (GitHub's X-Hub-Signature-256 is sha256= followed by the hex value).
How large a file can I hash?
Up to 256 MB here. The file is held in memory while it is hashed, which takes about a second per 100 MB on a typical laptop.