How to generate a hash
Type or paste text and all the hashes update as you type. To hash a file, such as a download you want to verify, choose it with the button or drop it onto the card; the bytes are read and hashed in your browser without being uploaded. Output is lowercase hex by default, with options for uppercase or Base64.
SHA-1, SHA-256, SHA-384 and SHA-512 are computed by the browser's Web Crypto API, the same native implementation used for HTTPS. MD5, which Web Crypto deliberately omits, is implemented in the page. Enter a secret key in the HMAC section to compute keyed hashes, used to sign webhooks and API requests. The key is held in a password field and never leaves the page.
Text is hashed as UTF-8 bytes. A trailing newline or different line ending changes the hash completely, which is the most common reason a hash does not match another tool's result.
Worked example
The SHA-256 hash of the three characters abc is:
ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015adIt is always 64 hex digits (256 bits) whatever the input size, and changing a single character produces a completely different value. For the same input MD5 gives 900150983cd24fb0d6963f7d28e17f72 and SHA-1 gives a9993e364706816aba3e25717850c26c9cd0d89d.
Choosing an algorithm
- SHA-256 or SHA-512: the right defaults for integrity checks, content addressing and signatures.
- MD5 and SHA-1: broken against deliberate collisions. Fine for spotting accidental corruption or matching legacy checksums; never for security.
- Passwords: never store a plain hash of a password, even SHA-512. Use a slow, salted password hash such as Argon2, scrypt or bcrypt.
- HMAC: use it, not
hash(key + message), to authenticate messages.
Hashing is one way: you cannot recover the input from the hash. To encode reversibly, see Base64. To verify a JWT signature algorithm, see the JWT decoder.
Frequently asked questions
Why does my hash differ from another tool's result?
Usually the input differs: a trailing newline, different line endings or a different text encoding. This tool hashes the exact UTF-8 bytes of what you typed. For files it hashes the raw bytes.
Is MD5 safe to use?
Not for security. Attackers can create different inputs with the same MD5. It remains acceptable for non-adversarial checksums, such as detecting accidental file corruption.
Can a hash be reversed?
No, hashing is a one-way function. Short or common inputs can be guessed by trying candidates, which is why passwords need salted, slow hashing.
How large a file can I hash?
Files up to 200 MB are accepted. The file is read into memory in your browser, so very large files depend on your device. Nothing is uploaded.