Type text or choose a file in this hash generator and get its MD5, SHA-1, SHA-256, SHA-384 and SHA-512 hashes at once, in hex or Base64. Switch on HMAC mode to sign with a secret key, and paste an expected checksum to see whether it matches. Files up to 500 MB are read and hashed in your browser; nothing is uploaded.
Loading the tool… It runs in your browser and needs JavaScript.
Table of Contents
How to use the hash generator
Text is hashed as UTF-8 bytes exactly as typed, so a trailing space or newline gives a completely different result. Choose File to hash a download, an ISO or a backup archive; you can also drop the file on the box. Paste the vendor’s published checksum into Compare with expected hash: the tool accepts upper or lower case hex, Base64, or a whole line copied from sha256sum output, and tells you which algorithm matched.
Why your hash does not match the command line
The usual cause is a newline. echo adds one, so echo "abc" | sha256sum hashes four bytes, not three. Use printf or echo -n:
printf '%s' 'abc' | sha256sum
sha256sum ubuntu.iso
sha256sum -c SHA256SUMS --ignore-missing
openssl dgst -sha512 backup.tar.gz
# Windows PowerShell
Get-FileHash .\setup.exe -Algorithm SHA256Other causes: Windows line endings (CRLF) in a text file, a different text encoding, or comparing a hex value with a Base64 value of the same hash.
HMAC: hashing with a key
An HMAC (RFC 2104) mixes a secret key into the hash, so only someone with the key can produce or check it. Webhooks from payment providers and Git hosts use HMAC-SHA256 signatures in a header; to debug one, paste the raw request body here, add the shared secret and compare the result with the header. The key can be entered as text or as hex bytes. HMAC-SHA uses the browser’s Web Crypto API; HMAC-MD5 uses the same small MD5 code as the plain MD5 row.
printf '%s' "$BODY" | openssl dgst -sha256 -hmac "$SECRET"Which algorithm should you use?
- SHA-256: the default for checksums and signatures today.
- SHA-384 and SHA-512: longer outputs; SHA-512 is often faster than SHA-256 on 64-bit CPUs.
- MD5 and SHA-1: practical collision attacks exist, so never use them for signatures, certificates or anything an attacker could tamper with. They are still fine for spotting accidental corruption, and many old mirrors only publish MD5 sums.
- Passwords: none of these. Store passwords with a slow, salted function such as Argon2id or bcrypt.
Limits and privacy
Text is limited to 10 MB and files to 500 MB, because the browser has to hold the whole file in memory for Web Crypto. For larger images use sha256sum on the machine itself. Nothing you hash leaves your device.
At a glance
Related tools: Secure Password Generator · Base64 Encoder and Decoder · Certificate Key Matcher: Free Safe Cert and Key Check · UUID Generator (v4 and v7).
Official documentation (checked 9 October 2026): RFC 1321: The MD5 Message-Digest Algorithm · NIST FIPS 180-4: Secure Hash Standard · RFC 2104: HMAC · MDN: SubtleCrypto.digest()
Found a Cisco "password 7" or "secret 5/8/9" string in a config? Use the Cisco Type 7 Password Decoder and Hash Identifier.
Frequently asked questions
Can a hash be reversed to get the original text?
No, hashes are one-way. Short or common inputs can still be found by guessing and comparing, which is why plain hashes must not be used for passwords.
Why do hex and Base64 outputs look different?
They are two spellings of the same bytes. Hex uses two characters per byte; Base64 is shorter. The compare box accepts either.
Is my file uploaded?
No. The file is read with the browser’s File API and hashed locally; there is no upload.