Hash Generator Online: SHA-256, MD5, SHA-1, SHA-512 and HMAC for Text and Files
Pick an algorithm from the menu, type or paste text, and this hash generator updates the digest as you type. Hash a file gives you the checksum of a download, an ISO image or a backup; the browser reads the file itself and nothing is uploaded. Put a secret in the HMAC key field and the output becomes a keyed HMAC, which is what you need to check a webhook signature. MD5, SHA-1, SHA-256, SHA-384 and SHA-512 are supported: the algorithms you actually run into in checksums, APIs and legacy systems.
What a hash function does
A cryptographic hash function turns input of any size into a fixed-size value, the hash or digest. The same input always gives the same hash; changing one character gives a completely different one; and it is designed to be infeasible to find the input from the hash, or two inputs with the same hash. That makes a hash a fingerprint: compare two hashes and you know whether two files or strings are identical, without comparing them byte by byte.
MD5 128 bits 32 hex characters 5d41402abc4b2a76b9719d911017c592
SHA-1 160 bits 40 hex characters aaf4c61ddcc5e8a2dabede0f3b482cd9aea9434d
SHA-256 256 bits 64 hex characters 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824
SHA-384 384 bits 96 hex characters
SHA-512 512 bits 128 hex characters (all hashes above are of the text "hello")Text is hashed as UTF-8 bytes, the same convention as sha256sum, Python's hashlib, Node's crypto and PHP's hash(), so results match between the generator and your code. Hash values are shown in lowercase hexadecimal; uppercase hex is the same value.
Which algorithm to use
Use SHA-256 by default. It belongs to the SHA-2 family standardised in NIST FIPS 180-4, is used by TLS certificates, Git's newer object format, Bitcoin and most software checksums, and has no known practical attacks. SHA-512 is equally secure and can be faster on 64-bit processors; SHA-384 is a truncated SHA-512 used in some TLS cipher suites and subresource integrity hashes.
MD5 and SHA-1 are broken for security. Researchers produced MD5 collisions in 2004, and Google and CWI Amsterdam published the first practical SHA-1 collision, SHAttered, in 2017. They remain fine for non-adversarial purposes, such as detecting accidental corruption, cache keys or matching old systems that still use them, but never for signatures, certificates or anything an attacker could forge.
None of these algorithms is suitable for storing passwords. They are designed to be fast, so a GPU can try billions of guesses per second. Use a password hashing function with a salt and a work factor, such as Argon2id, scrypt or bcrypt, which is what OWASP recommends.
Verify a downloaded file
Many projects publish a SHA-256 checksum next to each download. Choose the algorithm, click Hash a file, select the downloaded file, and compare the result with the published value. If a single character differs, the file is corrupted or not the one the publisher released. The comparison only proves integrity if the checksum comes from a trusted source, such as the project's HTTPS site or a signed checksum file, not from the same mirror as the file.
Under the result the generator prints the algorithm, the file name and the size in bytes. Compare the size with the one on the download page first: a truncated download shows up there before you read a single hex character. The whole file is loaded into the tab's memory before hashing, so for multi-gigabyte images the command line is the more reliable route.
The same check on the command line:
sha256sum ubuntu.iso # Linux
shasum -a 256 ubuntu.iso # macOS
Get-FileHash .\ubuntu.iso # Windows PowerShell (SHA256 by default)
certutil -hashfile ubuntu.iso SHA256 # Windows cmd
sha256sum -c SHA256SUMS # check every file listed in a checksum fileWhy your hash does not match
The most common cause is an invisible difference in the input. echo adds a newline, so echo "hello" | sha256sum hashes six bytes and returns 5891b5b5…, while the generator and printf 'hello' | sha256sum hash five bytes and return 2cf24dba…. Trailing spaces, Windows line endings and a byte order mark at the start of a file have the same effect.
Encoding matters too: héllo hashed as UTF-8 differs from the same word in Latin-1 or UTF-16. If one system hashes a hex or Base64 string and the other hashes the decoded bytes, the results will not match either. When comparing with another program, hash a simple ASCII word first to confirm both sides use the same algorithm.
HMAC: a hash with a secret key
An HMAC, defined in RFC 2104, combines a hash function with a secret key. Only someone who knows the key can produce the right value, so HMAC is used to authenticate messages: webhooks from Stripe, GitHub and Shopify, AWS request signatures and JWTs signed with HS256 are all HMAC-SHA256. Enter the key in the HMAC field and the output switches from a plain hash to the HMAC of your text.
The key field takes text and encodes it as UTF-8. If a provider gives you the secret as hex or Base64 and its documentation says to decode it before signing, the generator will not reproduce their signature, because it signs with the literal characters you typed. HMAC works with SHA-1, SHA-256, SHA-384 and SHA-512; with MD5 selected the tool shows an error instead of a result.
printf 'hello' | openssl dgst -sha256 -hmac 'secret'
# SHA2-256(stdin)= 88aab3ede8d3adf94d26ab90d3bafd4a2083070c3bcce9c014ee04a443847c0b
hash_hmac('sha256', 'hello', 'secret'); // PHP, same value
crypto.createHmac('sha256', 'secret').update('hello').digest('hex'); // Node.jsTo verify a webhook, compute the HMAC over the raw request body exactly as received, before any JSON parsing, and compare it with the signature header using a constant-time comparison. Some providers send the signature in Base64 rather than hex, and some sign a timestamp together with the body, so follow their documentation for the exact string.
Privacy
Hashes are calculated with the browser's Web Crypto API, and MD5 with a small JavaScript library, all on your device. Text, files and HMAC keys are not sent anywhere, so you can hash confidential documents or test real webhook secrets. A hash of a short or guessable input, such as a phone number or a common password, can still be reversed by guessing, so do not treat a hash of personal data as anonymous.
Frequently asked questions
How do I generate a SHA-256 hash?
Select SHA-256 and type or paste your text; the 64-character hash appears immediately. To hash a file, click Hash a file and select it. Nothing is uploaded.
Can a hash be decrypted?
No. A hash is a one-way function, not encryption. Short or common inputs can sometimes be found by guessing and looking up precomputed tables, which is why MD5 "decrypt" sites work only for weak inputs.
Why is my SHA-256 different from the command line?
Usually the input differs by a newline: echo adds one, so use printf. Check also for trailing spaces, Windows line endings and a different character encoding.
Is MD5 still safe to use?
Only for detecting accidental changes, such as corrupted downloads or cache keys. MD5 collisions can be created deliberately, so it must not be used for security, signatures or passwords.
What is HMAC-SHA256?
A SHA-256 based message authentication code that uses a secret key. It proves that a message came from someone who knows the key and was not changed, and is used for webhook signatures and HS256 JWTs.
Should I hash passwords with SHA-256?
No. General hashes are too fast and let attackers try billions of guesses. Store passwords with Argon2id, scrypt or bcrypt, which add a salt and a configurable cost.