Hash generator · Guide

Hash Generator C#: SHA-256, MD5 and HMAC in .NET

.NET has quietly replaced the old `using (var sha = SHA256.Create())` ceremony with one-line static methods. Most C# hashing code on the web is a decade out of date, and the modern version is both shorter and harder to get wrong.

Open tool

The modern API

Since .NET 5, static HashData methods do the whole job with no disposable object, and Convert.ToHexString handles formatting:

using System.Security.Cryptography;
using System.Text;

byte[] bytes  = Encoding.UTF8.GetBytes("hello");
byte[] digest = SHA256.HashData(bytes);
string hex    = Convert.ToHexString(digest).ToLowerInvariant();

Two details that cause mismatches: specify Encoding.UTF8 explicitly rather than relying on a default, and remember Convert.ToHexString returns uppercase — lowercase it if you are comparing against sha256sum output.

Hashing files without loading them

Stream the file so memory stays flat regardless of size:

await using var stream = File.OpenRead("release.zip");
byte[] digest = await SHA256.HashDataAsync(stream);
string hex = Convert.ToHexString(digest).ToLowerInvariant();

This matches Get-FileHash and sha256sum exactly, since all three read raw bytes with no transformation.

HMAC and safe comparison

For keyed digests use the HMAC classes, and never compare signatures with ==:

byte[] signature = HMACSHA256.HashData(key, message);

// constant-time — prevents timing attacks
bool valid = CryptographicOperations.FixedTimeEquals(signature, expected);

For passwords, none of these are the right tool: use Rfc2898DeriveBytes with a high iteration count, or better, a bcrypt or Argon2 package from NuGet.

Frequently asked questions

Do I still need to dispose the hash object?

Not with the static HashData methods — there is no instance to dispose. The older Create() pattern still requires it.

Why does my C# hash differ from the command line?

Usually encoding: .NET strings are UTF-16, so you must convert with Encoding.UTF8 before hashing.

Is MD5 still available in .NET?

Yes, via MD5.HashData, though it is blocked in FIPS-compliant environments and should not be used for security.

Ready to try it?

Open the free browser-based Hash generator and apply what you just read — no sign-up, runs locally.

Open the Hash generator tool