What is the hash generator?
Computing MD5, SHA-1, SHA-256, SHA-384 and SHA-512 checksums of any text or file at once, the Hash Generator also signs messages with keyed HMAC and verifies a download against its expected hash. It runs on the browser's native Web Crypto API, so inputs, keys and files are never uploaded or logged. Free to use.
A cryptographic hash turns any input (a password, a config string, a multi-gigabyte ISO) into a short, fixed-length fingerprint. Change a single byte and the fingerprint changes completely, which is why hashes are the standard way to verify that a download arrived intact, that two files are identical, or that a message hasn't been tampered with. This Hash Generator computes MD5, SHA-1, SHA-256, SHA-384 and SHA-512 for the same input simultaneously, so you never have to re-run the tool once per algorithm, and each digest gets its own copy button. Type or paste text and the hashes update live. Drag in a file and it is streamed through the hash in chunks so even large files stay within memory instead of loading all at once. Switch to HMAC mode to sign a message with a secret key using HMAC-SHA256 and friends: the exact primitive behind webhook signatures and API request signing. And when you just want to confirm a checksum, paste the expected value into the verify field and the tool tells you instantly, with a color-coded badge, whether it matches any of the computed digests. Everything runs client-side through the browser's native Web Crypto API (MD5 via a small in-browser library, since Web Crypto omits it). No input, key or file is ever transmitted, stored or logged.
- Difficulty:
- Easy
- Typical time:
- ~15s
- Processing:
- 100% browser processing
Last updated
How to use the hash generator
- 1
Enter your input
Type or paste text into the input pane, or drag a file onto it. Digests recompute live for text. For a file, the hash appears as soon as it finishes reading.
- 2
Read all the hashes
MD5, SHA-1, SHA-256, SHA-384 and SHA-512 appear stacked together. Copy any one with its button, or flip the uppercase toggle to match your target format.
- 3
Sign with HMAC (optional)
Turn on HMAC mode and enter a secret key to produce keyed HMAC signatures instead of plain digests. MD5 is skipped, since Web Crypto has no MD5-HMAC.
- 4
Verify against an expected hash
Paste the checksum you were given into the verify field. A match/no-match badge lights up the moment it agrees with any computed digest, ignoring case and whitespace.
What Hash Generator includes
Every algorithm at once
One input, five digests. MD5, SHA-1, SHA-256, SHA-384 and SHA-512 are computed together and shown in a stacked list, each with its own copy button. No re-running the tool per algorithm.
Hash files, even large ones
Drag a file onto the pane to fingerprint it. Files are read in 8 MiB chunks so multi-gigabyte inputs stay within memory, and the result matches the checksums published on release pages.
HMAC keyed signing
Flip on HMAC mode, enter a secret key, and the tool signs your message with HMAC-SHA256 (or SHA-1/384/512) via Web Crypto: the same construction used for webhook and API request signatures.
One-click checksum verify
Paste an expected hash into the verify field and a live badge tells you whether it matches any computed digest (case-insensitive) so confirming a download's integrity takes one paste.
Uppercase toggle
Switch every digest between lowercase and uppercase hex in one click, to match whatever format a vendor, checksum file or verification script expects.
Fully client-side
All hashing and HMAC signing happen inside your browser tab with the native Web Crypto API. Your text, keys and files are never uploaded, cached or logged anywhere.
Why use our hash generator
Verify downloads with confidence
Drop an installer or ISO in, compare its SHA-256 against the value on the project's release page, and know instantly whether the file is authentic and uncorrupted before you run it.
Sign requests without a script
Generate an HMAC-SHA256 signature for a webhook payload or API request on the spot, so you can test integrations and debug signature mismatches without writing throwaway code.
Safe for secrets and private files
Because nothing leaves your browser, you can hash sensitive files, tokens or HMAC keys here without worrying that a server logged your input or kept a copy.
No installs, no limits
It's one web page that works on any device. No OpenSSL command to remember, no per-day cap, no account. Hash as many strings and files as you want.
Built for the way you work
From quick one-off fixes to daily workflows, see how people put this tool to use.
- DevOps & release engineers
Check release artifact integrity
Confirm that a binary, container layer or build artifact matches the SHA-256 in your release notes before you promote it, catching a corrupted or swapped file early.
- Backend developers
Build and debug HMAC signatures
Reproduce the exact HMAC-SHA256 signature your API or webhook expects, and diff it against what your code produces to find why a 'signature invalid' error keeps firing.
- Security & IT teams
Fingerprint files for incident response
Compute a file's MD5 and SHA-256 to look it up in threat-intelligence databases or to prove two collected samples are byte-for-byte identical.
- Anyone downloading software
Confirm a download is genuine
Paste the checksum from a project's website and drop the file you downloaded. A green badge means it's intact and unmodified, a red one means download it again.
Supported formats
Accepts Text, UTF-8 string, Any file, Drag & drop and Paste, and produces MD5, SHA-1, SHA-256, SHA-384 and SHA-512, all processed locally in your browser.
- Text
- UTF-8 string
- Any file
- Drag & drop
- Paste
- MD5
- SHA-1
- SHA-256
- SHA-384
- SHA-512
- HMAC
- Hex
Frequently asked questions
Recommended tools
Base64 Encoder
Encode text or any file to Base64 instantly: Unicode-safe, with a URL-safe toggle and one-click data URLs. Runs entirely in your browser, nothing uploaded.
JWT Decoder
Decode and inspect any JSON Web Token instantly. Read the header, payload and signature, see when it was issued and expires, and optionally verify an HS256 signature. 100% in-browser. Your token never leaves your device.
UUID Generator
Generate secure UUIDs instantly, random v4, time-ordered v7, or the nil UUID. Bulk-generate up to 1,000, copy or export as TXT/CSV, all in your browser.
JSON Formatter
Format, validate and minify JSON in your browser with pinpoint error line + column, jump-to-error, key sorting and live editing: nothing is uploaded.
Barcode Generator
Generate scannable 1D barcodes (CODE128, EAN-13, UPC-A, CODE39, ITF-14, MSI, pharmacode and Codabar) live in your browser, with per-format validation and PNG or SVG export. Nothing is uploaded.
Base64 Decoder
Decode Base64 back to text or a file instantly: Unicode-safe, auto-detects URL-safe input, sniffs binary data and offers a download. Runs fully in your browser, nothing uploaded.
Comparisons & guides
Go deeper on the concepts behind the hash generator.
Common problems, solved
Hit a snag? Here are quick fixes for the issues people run into most.
My computed hash doesn't match the one on the download page.
Confirm you're comparing the same algorithm (a SHA-256 value won't match a SHA-512 line), that you hashed the file and not a copied snippet of text, and that the download completed fully. A mismatch on a fully downloaded file means it was corrupted or tampered with: re-download from the source.
HMAC signature comes out different from my server's.
Check that the key is byte-identical (no trailing newline, no Base64 wrapping), that both sides sign the exact same message bytes, and that you're using the same SHA variant. Even one differing byte in key or message changes the whole signature.
A large file seems to hang while hashing.
Big files take time to read from disk. The SHA algorithms read the buffer once before producing a digest. Give it a few seconds and avoid switching tabs mid-read. If the file is enormous, MD5 (which streams) will begin returning fastest.
The hash of my text doesn't match a command-line tool.
The most common cause is a trailing newline: 'echo foo' adds one, 'printf foo' doesn't. This tool hashes exactly the characters in the input box as UTF-8. Remove or match the newline and the digests will agree.
Get the most out of it
Use SHA-256 or stronger for anything security-related. Keep MD5 and SHA-1 only for quick, non-security integrity checks where speed matters and collisions don't.
When a checksum won't match, hash the file rather than pasted text. Copying text can silently add or strip a trailing newline and change the digest.
For HMAC signatures, make sure the key is the raw secret, byte for byte. A Base64-wrapped or newline-padded key will produce a different, 'invalid' signature.
Toggle uppercase to match vendor checksum files exactly, but remember the verify field already ignores case, so you rarely need to.
To compare two files, hash the first, copy its SHA-256, then hash the second and paste that value into verify for an instant identical/different answer.
What's new
Recent updates and improvements to the hash generator.
Initial release: simultaneous MD5, SHA-1, SHA-256, SHA-384 and SHA-512 for text and dropped files, each with its own copy button and an uppercase toggle.
Added HMAC mode with a secret-key field (HMAC-SHA1/256/384/512) and chunked file reading so large files hash without exhausting memory.
Added the checksum verify field with a live match/no-match badge, paste and share support, and keyboard shortcuts with an in-app reference.
Keep exploring
Problems we solve
Definitions
From the blog
- No AI Inside: How Our Regex Generator Actually Works
- How to Hash Data with SHA-256: Checksums, MD5, and Salting Explained
- Does llms.txt Do Anything? An Honest Answer
- How to Find Exposed API Keys in Your Code (Before Someone Else Does)
- How to Generate TypeScript Types from JSON (API Responses Made Type-Safe)
Explore categories
Compare formats
Common tasks
Your privacy is built in
Every digest, HMAC and comparison is computed entirely inside your browser tab using the native Web Crypto API, with a small in-browser library for MD5, which Web Crypto omits. Your text, your HMAC secret key and any file you drop in are never uploaded, cached, or logged on our servers. That local-only design is what makes it safe to fingerprint private files and hash sensitive strings here. Note that MD5 and SHA-1 are unsafe against deliberate collisions. Use SHA-256 or stronger for security-sensitive work.
- Runs in your browser
- No uploads
- Nothing stored
Ready to try the hash generator?
Free, private and instant. Hash Generator runs right in your browser.