How to use the hash generator
- Choose Text and type or paste your input, or choose File and drop a file of up to 200 MB.
- Read the five digests as they compute. Toggle Uppercase hex if the system you're matching prints capitals.
- To verify a download, paste the checksum from the vendor's page into the Compare field. The matching algorithm lights up green.
- Switch on HMAC and enter a secret key to produce keyed signatures, as used by webhook verification and API signing.
- Copy a single digest with its button, or copy or download all of them as a checksums file.
Features
- MD5, SHA-1, SHA-256, SHA-384 and SHA-512 side by side, computed in parallel
- Hashes files locally with the WebCrypto API, so large files never leave your device
- HMAC mode for every algorithm, including HMAC-MD5 and HMAC-SHA256
- Checksum verification: paste an expected value and see which digest matches
- Uppercase or lowercase hex, per-digest copy buttons and a downloadable checksums file
Which algorithm should you use?
SHA-256 is the sensible default for integrity checks, signatures and content addressing; it is what most download pages, Git (in SHA-256 mode), Docker and package managers use today. SHA-512 is slightly faster on 64-bit hardware and produces a longer digest; SHA-384 is a truncated SHA-512 often required by compliance profiles.
MD5 and SHA-1 are cryptographically broken: attackers can craft two different inputs with the same hash. They are still fine for detecting accidental corruption or de-duplicating files, and many legacy systems print them, but never rely on them for security decisions such as password storage or signatures.
How text is hashed
Text is encoded as UTF-8 before hashing, which is what command-line tools such as sha256sum and most programming languages do. That means a trailing newline, a Windows line ending or a different Unicode normalisation of an accented letter each produce a different digest. If your result doesn't match another tool, the usual culprit is an invisible trailing newline: echo adds one, printf doesn't.
HMAC versus a plain hash
An HMAC combines the message with a secret key so that only someone who knows the key can produce or verify the value. Services such as GitHub, Stripe and Slack sign webhook payloads with HMAC-SHA256; you can paste the raw request body and the signing secret here to reproduce the signature while debugging. Note that the key is also used as UTF-8 text; if your key is hex or Base64, decode it first.