How to use the Hash Generator
- Type text into the box, or switch to File and choose a file.
- All five hashes appear at once. Choose hex or Base64, and uppercase if you need it.
- To check a download, paste the published checksum into Compare with a hash.
- For HMAC, type the secret key. Click Copy next to any hash.
Which hash should I use?
| Algorithm | Length | Use it for |
|---|---|---|
| MD5 | 128 bits (32 hex characters) | Checking downloads and finding duplicate files. Not secure: collisions can be made on purpose. |
| SHA-1 | 160 bits (40 hex) | Legacy systems and Git object IDs. Also broken for security. |
| SHA-256 | 256 bits (64 hex) | The safe default: checksums, signatures, blockchains, API request signing. |
| SHA-384 / SHA-512 | 384 / 512 bits | When a standard asks for them, or for extra margin. SHA-512 can be faster on 64-bit machines. |
Verify a download
Many sites publish a checksum next to a download. Switch to File, choose the file, and paste the published value into Compare with a hash. A green ✓ Match means your copy is identical to the original. The file is read in your browser and never uploaded, so this works for large and private files too.
HMAC
An HMAC mixes a secret key into the hash, so only someone who knows the key can produce the same value. APIs and webhooks, for example from Stripe, GitHub or Slack, sign requests with HMAC-SHA256. Type the secret into HMAC secret key and every hash becomes an HMAC.
Don't use these for passwords
MD5 and SHA hashes are designed to be fast, which makes guessing passwords fast too. Store passwords with a slow, salted algorithm such as Argon2, bcrypt or scrypt instead.
Frequently asked questions
Is my text or file uploaded?
No. Hashes are calculated in your browser: SHA with its built-in Web Crypto, and MD5 with code that runs on the page. It even works offline.
Can a hash be reversed?
No. A hash is one-way. Short or common inputs can sometimes be found by guessing, which is why passwords need slow, salted hashing.
Why is my hash different from another tool's?
The input must match byte for byte. Check for a trailing newline or space, and whether the text is UTF-8. Files are hashed exactly as they are.
What's the difference between hex and Base64?
They're two ways of writing the same bytes. Hex uses 0–9 and a–f; Base64 is shorter. Most checksums are published in hex.