Hash Generator

How to use the hash generator

1. Type or paste text, or switch to the File tab and choose a file. The five hashes appear straight away and update as you type.
2. Copy any of them with its Copy button. Tick Uppercase hex if the system you are using expects capital letters.
3. To check a download, paste the checksum the publisher gave you into Compare. The tool says which algorithm it matches, or why it does not.

Everything is calculated in your browser. Text and files are never uploaded, so it is safe to check private documents. Files up to 50 MB are supported.

What a hash is

A hash function turns any amount of data into a fixed-length fingerprint. The same input always gives the same fingerprint, but even a one-character change produces a completely different one, and there is no practical way to work backwards from the fingerprint to the original data.

Compare the SHA-256 hashes of hello and Hello, which differ by a single capital letter:

hello → 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824 Hello → 185f8db32271fe25f561a6fc938b2e264306ec304eda518007d1764826381969

No part of the two results looks alike. This is called the avalanche effect, and it is why a hash is a reliable way to tell whether two copies of a file are exactly identical.

The algorithms

MD5 and SHA-1 are still fine for spotting accidental corruption, but they must not be used where someone might try to forge a matching file. Prefer SHA-256 or higher.

Worked example: verifying a download

1. The publisher lists the SHA-256 checksum of their installer on their website.
2. Download the file, open the File tab and choose it.
3. Paste the published checksum into Compare. A green ✓ Match means your file is byte-for-byte identical to the one that was hashed. A mismatch means the download was corrupted or altered, so download it again from the official source.

For text, known test values let you confirm the tool is correct: the MD5 of abc is 900150983cd24fb0d6963f7d28e17f72, the SHA-1 is a9993e36…0d89d, and the SHA-256 is ba7816bf8f01cfea…0015ad. The empty string hashes to d41d8cd98f00b204e9800998ecf8427e in MD5.

Hashes are not for storing passwords

A common mistake is to store passwords as a plain SHA-256 or MD5 hash. These algorithms are designed to be fast, which helps an attacker who steals the database: modern graphics cards can test billions of guesses per second, and common passwords are already listed in pre-computed tables. Passwords should be stored with a purpose-built slow function with a unique salt, such as Argon2, bcrypt or scrypt. This tool is for checking data integrity, not for protecting passwords.

HMAC is a different tool. It mixes a secret key into the hash, so only someone with the key can create or verify the result. It is used to sign API requests and webhooks. Tick the HMAC option and enter a key to compute it. For example, HMAC-SHA256 with the key key over “The quick brown fox jumps over the lazy dog” is f7bc83f430538424b13298e6aa6fb143ef4d59a14946175997479dbc2d1a3cd8.

Checking a file's hash on your own computer

These built-in commands give the same result as this page, which is a good way to confirm both. Use the page when you do not want to open a terminal, or when you want all five algorithms at once. For multi-gigabyte files, the command line is faster, because this page reads the whole file into memory and is limited to 50 MB.

Accuracy and limits

Text is converted to UTF-8 bytes before hashing, which is what nearly all systems do. If another tool shows a different result for the same text, check for a trailing newline, different encoding (such as UTF-16) or Windows line endings. SHA hashing relies on the browser's secure Web Crypto interface, which needs an HTTPS page. MD5 is calculated by code in the page. Files are read fully into memory, so the size is limited to 50 MB.

Frequently asked questions