Hash Generator
Hash text as you type or drop a file to get its checksums, then paste the expected hash to confirm a download matches. Everything is computed on your device.
How it works
A hash function turns any input into a fixed-length fingerprint. Change a single bit and the fingerprint changes completely, which is why publishers list a checksum next to downloads: hash the file you received, paste their value into the compare box, and a match means the file is intact.
SHA-1, SHA-256, SHA-384 and SHA-512 use your browser’s built-in Web Crypto API. MD5 is not in Web Crypto, so this page includes a small, standard implementation that streams large files chunk by chunk. Files are read locally; the progress bar shows how much has been read.
Add an HMAC key to get a keyed signature instead of a plain hash — the value APIs like Stripe and GitHub use to sign webhooks.
Questions
Which hash should I use?
SHA-256 for almost everything: checksums, integrity checks, content addressing. MD5 and SHA-1 are broken for security — attackers can craft two different files with the same hash — so only use them to match an older checksum someone else published.
Can I hash passwords with this?
You can, but you shouldn’t store passwords as plain SHA or MD5 hashes: they are fast to compute, so leaked hashes are easy to brute-force. Use a slow password hash such as Argon2, bcrypt or scrypt.
How do I get the same checksum on the command line?
macOS/Linux: shasum -a 256 file or sha256sum file, and md5 file / md5sum file. Windows PowerShell: Get-FileHash file -Algorithm SHA256. The hex output should match this page exactly (letter case doesn’t matter).
Why is my text hash different from another tool’s?
Usually a hidden difference in the input: a trailing newline, Windows line endings (CRLF) or a different text encoding. This page hashes exactly what is in the box as UTF-8, with no newline added.
Are my files uploaded?
No. Files are read in your browser and hashed on your device. Nothing is sent over the network.