Hash Generator
A hash generator for text and files: MD5, SHA-1, SHA-256, SHA-384, SHA-512 and CRC32, in hexadecimal or Base64. Add a secret key for HMAC, and paste an expected checksum to confirm a download arrived intact.
How to use Hash Generator
- Type or paste text, or switch to the File tab and drop a file to hash it.
- Read every algorithm at once in the results table, or copy just the one you need.
- Switch the output between lowercase hex and Base64 to match whatever you are comparing against.
- Turn on HMAC and enter a secret key to produce a keyed message authentication code.
- Paste a published checksum into the compare box to confirm it matches, character for character.
About Hash Generator
A hash function turns any input into a fixed-length fingerprint. The useful property is that changing a single bit of the input changes roughly half the bits of the output, so comparing two short hex strings tells you whether two files are byte-identical without comparing the files themselves. That is why download pages publish SHA-256 sums, why Git names objects by their digest, and why "check the hash" is the standard first step when something arrives corrupted.
The algorithms here fall into three groups. SHA-1, SHA-256, SHA-384 and SHA-512 run on the browser’s native SubtleCrypto implementation, which is fast and constant-time. MD5 and CRC32 are not in that API — deliberately, because neither is considered secure — so they are implemented in JavaScript here for the legacy cases that still need them: verifying an old mirror, matching a database column, or reproducing a ZIP checksum. Treat both as integrity checks only.
HMAC is the keyed variant, and it is the mode most people actually need when integrating with a third party. Webhook signatures, API request signing and session-token integrity all use HMAC-SHA256 over an exact byte sequence, and the usual reason a comparison fails is not the algorithm but the input: a re-serialised JSON body, a trimmed trailing newline, or a hex-versus-Base64 mismatch. The comparison box exists for exactly that moment — paste the expected value, and the tool tells you which algorithm and encoding it matches, if any.
Frequently asked questions
Are my files uploaded to be hashed?
No. Files are read into memory on your device and hashed with the browser’s built-in crypto.subtle.digest. Nothing is transmitted, so verifying a private archive or an ISO is entirely safe.
Is MD5 still safe to use?
Not for anything security-related. Practical collision attacks against MD5 have existed since 2004, and SHA-1 fell in 2017. Both remain useful as fast integrity checks against accidental corruption, and MD5 is still what many mirrors publish — but for signatures, password storage or anything an attacker can influence, use SHA-256 or better.
Can I hash a large file?
Yes. Files are read as an ArrayBuffer and passed to the native digest implementation, which is written in C++ and hashes hundreds of megabytes per second. The practical ceiling is your available memory, not the algorithm — a few gigabytes will strain a phone, not a laptop.
What is HMAC and when do I need it?
HMAC combines a hash with a secret key so that only someone holding the key can produce a valid digest. It is what webhook providers such as Stripe and GitHub use to sign payloads: you recompute the HMAC over the raw body and compare it with the header they sent.
Why does the same file give a different hash elsewhere?
Almost always a text-encoding or line-ending difference. Hashing "hello\n" is not hashing "hello", and a file saved with CRLF endings hashes differently from the same file with LF. When hashing text here, the input is encoded as UTF-8 with no trailing newline added.
Is CRC32 a hash?
It is a checksum, not a cryptographic hash. CRC32 is designed to detect accidental corruption in transmission — it is fast and produces only 32 bits, so collisions are trivially easy to construct on purpose. Use it for ZIP entries and integrity spot-checks, never for security.
Related tools
- JWT Decoder — Decode and verify JSON Web Tokens
- JSON Formatter — Beautify, validate & minify JSON
- Base64 Encoder & Decoder — Text and files to Base64, both ways
- Regex Tester — Test regular expressions live
- Diff Checker — Compare two texts line by line
- URL Encoder & Decoder — Percent-encode and inspect URLs