Hash Generator (MD5, SHA256)
Generate SHA-1, SHA-256, SHA-384, SHA-512, or legacy MD5 checksums locally. Your work stays on this device whenever possible.
How to use Hash Generator (MD5, SHA256)
- Type or paste text into the input box (the default is the word hello), or choose 'Input is' Hex bytes or Base64 bytes to hash raw data.
- Choose 'Mode:' 'All Hashes Matrix' (13 algorithms), 'Single Algorithm' or 'HMAC (Keyed Secret)'. For HMAC enter the 'HMAC Secret Key' and say whether it is text, hex or Base64.
- Pick 'Show digest as' hex, Base64 or Base64url, and toggle 'Uppercase' or 'Group Bytes' for hex.
- Paste a known digest into 'Compare against expected checksum': the page names which algorithm it matches, or lists which algorithms have that length when nothing matches.
- To hash files, drop them on 'Hash files', tick the algorithms and read the per-file table. To verify a download, paste a SHA256SUMS list into 'Verify files against a checksum manifest', select the files and read PASS, FAIL, MISSING and NOT LISTED for each. The command lines below show the matching sha256sum, Get-FileHash, certutil and openssl checks.
Worked example
With the default text hello and 'All Hashes Matrix', SHA-256 is 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824, MD5 is 5d41402abc4b2a76b9719d911017c592 and CRC32 is 3610a686. Pasting the SHA-256 value into the compare box shows MATCH (SHA-256) and lists the other algorithms with 64 hex characters. Switch to HMAC, enter the key k and the MD5 row becomes a keyed HMAC-MD5.
When to use this tool
- Verifying a downloaded ISO or installer against the publisher's SHA256SUMS file without uploading it.
- Confirming that a copied API payload matches the digest in vendor documentation.
- Generating a quick HMAC while checking how a webhook signature is computed.
Important limitations
Cryptographic hashes are one-way digests, not reversible encryption. Fast hashes are unsuitable for password storage without salt/stretching, and MD5/SHA-1 have known collision vulnerabilities.
Frequently asked questions
Which algorithms are included?
MD5, SHA-1, SHA-224, SHA-256, SHA-384, SHA-512, SHA-512/256, SHA3-224/256/384/512, BLAKE3 (32-byte output) and CRC32. They come from a small pure-JavaScript kit tested against Node's crypto library and published test vectors, so files can be hashed in slices instead of loaded whole.
Can it hash a file?
Yes. Choose or drop files under 'Hash files'. They are read in 4 MB slices with a progress figure and Cancel button, so multi-gigabyte files do not need to fit in memory, though pure JavaScript is slower than a native tool. Nothing is uploaded.
How does HMAC mode work now?
Every algorithm that defines HMAC is keyed with your secret: MD5, SHA-1, SHA-2 and SHA-3 (using the correct block size for each). CRC32 has no HMAC, and BLAKE3 has its own keyed mode that is not HMAC, so those rows say so instead of showing an unkeyed digest. An empty key shows a notice and no digests.
Is MD5 safe to use?
MD5 and SHA-1 are flagged as broken: practical collisions exist. They can still catch an accidental change, but should not be used for signatures, integrity against an attacker, or password storage. CRC32 only detects accidental errors.
How does the compare box work?
It ignores spaces and colons, accepts hex or a Base64 digest, and checks the value against every algorithm currently shown. A hash length can be shared by several algorithms (64 hex characters is SHA-256, SHA-512/256, SHA3-256 or BLAKE3), so a match names the one that actually produced it.
Why is my hash different from the one on the website?
The usual causes are a trailing newline or different line endings in the text, hashing the text instead of the file (or the reverse), a different algorithm with the same length, or an HMAC key that the website used. Text is hashed as UTF-8 bytes exactly as typed.