Hash Generator
MD5, SHA-1 and SHA-256 hashes.
Input
13 bytesHashes
Type something and its hashes appear here.
Paste a hash from a download page to check it against these results.
- Input
- 13 bytes
- Hashed in
- None
- Algorithms
- 6
A hash generator that checks as well as creates
Get every common hash of a text or file in one place, then compare it with the value you were given. It all runs in your browser.
- Six hashes at once. MD5, SHA-1, SHA-256, SHA-384, SHA-512 and CRC32 are worked out together and update as you type, each marked as secure, broken or a plain checksum.
- Text or any file. Type text, or drop a file up to 256 MB. Both are read on your device and never uploaded.
- Verify a download. Paste the hash from a download page into Compare with a hash. The matching row lights up, and if it does not match the tool tells you which algorithm it looks like.
- HMAC with a secret key. Switch on the key icon to sign the input with a secret key, the way APIs and webhooks sign requests. An empty key and a very long key both work.
- Hex, Base64 and URL-safe Base64. Pick the output format, and switch hex between lowercase and uppercase. Copy one hash, copy all, copy as JSON or download.
Uses of hash
A hash is useful wherever you need a short fingerprint of some data. These are the most common uses and the algorithm that suits each.
- Checking a download. Websites publish a SHA-256 next to a file. Hash your copy and compare, and you know it arrived whole and was not swapped on the way.
- Finding duplicate files. Two files with the same hash are almost certainly identical, whatever their names. This is how backup and sync tools spot copies.
- Signing API requests and webhooks. Services such as payment and Git hosts sign each request with an HMAC-SHA256 and a shared secret. Use the key option to build or check one while debugging.
- Cache keys and ETags. A hash of the content makes a short key that changes only when the content does, so caches and browsers know when a file is new.
- Matching an older system. Some old APIs, package lists and databases still use MD5 or SHA-1. Make the same value here to compare or test against them. Do not pick these for anything new that needs to be secure.
- Catching accidental damage. CRC32 is quick and spots a flipped bit or a bad transfer. It is used in ZIP, PNG and network data, but it does not stop someone changing data on purpose.
- Checking a copy of text. Hash two versions of a config, a contract or a log line to see at a glance whether they are exactly the same, down to a single space.
- Tests and fixtures. Make known hashes to use as expected values in tests, and copy them as JSON or in Base64 to paste straight into code.
Hash generator questions
What is a hash?
A hash is a short fixed-length fingerprint of some data. The same input always gives the same hash, a tiny change gives a completely different one, and you cannot work backwards from the hash to the input.
Which algorithm should I use?
Use SHA-256 for most things, such as checking files. SHA-384 and SHA-512 are longer SHA-2 variants. MD5 and SHA-1 are broken for security and are only useful to match an older system. CRC32 only catches accidental damage.
Can I store passwords with these hashes?
No. These hashes are made to be fast, which helps an attacker guess passwords. Use a slow password hash such as Argon2, scrypt or bcrypt for passwords.
Why does my hash not match?
The usual cause is a hidden trailing new line, which changes every hash. Turn on Ignore trailing line breaks. Also check for extra spaces, a different text encoding and the wrong algorithm. Text is hashed as UTF-8.
What is HMAC?
HMAC mixes a secret key into the hash so only someone with the key can produce or check it. It is used to sign API requests and webhooks. CRC32 has no HMAC form, so it is hidden when the key is on.
Is my data sent anywhere?
No. Hashing runs in your browser, using the built-in Web Crypto for SHA and a local version of MD5 and CRC32. Nothing you type or choose leaves your device.