by GelFuzion
Home / Code & Data / Hash Generator
04.10Code & Data

Hash Generator: SHA-256, MD5, SHA-1, SHA-512

Generate SHA-256, SHA-1, SHA-384, SHA-512 and MD5 hashes of any text or file, create HMAC signatures, and verify a checksum in one paste. Nothing is uploaded.

Updated

Hashes

What a hash generator does

A hash generator runs your input through a cryptographic hash function and returns a fixed-length fingerprint. Feed SHA-256 a single word or a 4 GB video and you get back exactly 64 hex characters. Change one bit of the input and the output changes completely, with no visible relationship to the old one. That makes hashes ideal for checking that a file arrived intact, comparing data without storing it, building cache keys, and signing webhook payloads.

This tool computes MD5, SHA-1, SHA-256, SHA-384 and SHA-512 side by side. The SHA family runs on your browser's built-in Web Crypto API, and MD5, which browsers no longer include, is implemented in plain JavaScript on this page. Nothing you type or drop here is sent anywhere.

How to generate a hash

  1. Choose Text or File. Text is encoded as UTF-8 before hashing, which matches what sha256sum, PHP, Python and Node produce for the same string.
  2. Type, paste or drop. Hashes update as you type. Files are read locally, with a progress bar for large ones.
  3. Pick the output format. Hex is what checksums and most APIs use. Base64 is shorter and common in HTTP headers such as Content-Digest and Subresource Integrity attributes.
  4. Copy a single hash or all of them with the buttons beside each row.

Verifying a download checksum

Software publishers list a SHA-256 checksum next to the download link so you can confirm the file you got is the file they released. Switch to File, drop in the download, and paste the published value into the verify box. You do not need to say which algorithm it is: the tool compares it against every result, ignoring case and spaces, and highlights the match. No match means the download is incomplete, damaged, or has been swapped.

HMAC: hashing with a secret key

An HMAC mixes a secret key into the hash, so only someone with the key can produce or check it. Stripe, GitHub, Shopify and Slack all sign webhook requests this way. To debug a failing webhook signature, paste the raw request body exactly as received, enter your signing secret, and compare the HMAC-SHA256 here with the signature header. The most common cause of a mismatch is hashing parsed and re-serialized JSON instead of the raw bytes.

// Node.js equivalent of this tool's HMAC-SHA256 hex output
const crypto = require('crypto');
crypto.createHmac('sha256', 'my-webhook-secret')
  .update('The quick brown fox jumps over the lazy dog')
  .digest('hex');

// Plain SHA-256 from a terminal (printf avoids the trailing newline)
printf '%s' 'hello' | shasum -a 256

Which algorithm should you use?

  • SHA-256 is the default choice for checksums, signatures, integrity attributes and anything security related.
  • SHA-384 and SHA-512 give longer outputs and are often faster than SHA-256 on 64-bit machines. SHA-384 is the usual pick for Subresource Integrity.
  • SHA-1 is broken for collision resistance. Keep it only for compatibility, such as Git object IDs or legacy systems.
  • MD5 is fast and short, and fine for detecting accidental corruption or deduplicating files you control. Never use it where an attacker could craft the input.

Common mistakes

  • Trailing newlines. echo "hello" | md5sum hashes six bytes, not five. Use printf or echo -n.
  • Hashing passwords with SHA-256. It is far too fast. Use Argon2id or bcrypt. If you need strong random secrets in the first place, the password and key generator makes them, and the secret share link tool sends them safely.
  • Calling a hash encryption. Hashes cannot be decrypted. If you need to send a password and get it back, read how to send passwords securely.
  • Mixing encodings. The same text in UTF-8 and UTF-16 has different bytes, and different hashes. This tool always uses UTF-8.

One practical limit: very large files must fit in your browser's memory. Files up to a couple of gigabytes work in most desktop browsers. MD5 is computed in JavaScript, so on files over about 200 MB it is noticeably slower than the SHA algorithms.

Frequently asked questions

Can a hash be reversed or decrypted?

No. A hash is a one-way fingerprint, not encryption, so there is no key that turns it back into the input. Sites that claim to decrypt MD5 or SHA-1 simply look the hash up in huge tables of previously hashed common strings, which is why short or common inputs are easy to find and long random ones are not.

Is MD5 still safe to use?

Not for security. Researchers can create two different files with the same MD5 hash, and SHA-1 has the same problem. MD5 is still fine for spotting accidental corruption or as a cache key, but use SHA-256 for anything where someone might deliberately tamper with the data.

How do I verify a file checksum?

Switch to File, drop in the file you downloaded, then paste the checksum from the publisher's website into the verify box. The tool checks it against every algorithm and tells you which one matches. If none match, the download is incomplete, corrupted, or not the file the publisher released.

Why does my hash not match the one from the command line?

Usually a hidden newline. echo adds a line break at the end, so echo hello | sha256sum hashes hello plus a newline. Use echo -n or printf instead. Different text encodings and Windows line endings also change the bytes, and therefore the hash.

Should I use SHA-256 to hash passwords?

No. Fast hashes like SHA-256 let attackers try billions of guesses per second. Store passwords with a slow, salted algorithm designed for the job, such as Argon2id, bcrypt or scrypt, which your framework or language almost certainly provides.