Hash Generator

What this hash generator does

Paste in any text, or drop in a file, and this tool computes MD5, SHA-1, SHA-256, SHA-384, and SHA-512 hashes instantly — all in your browser, nothing is ever uploaded to a server. It's built for the two things people actually use a hash generator for: generating a checksum to compare against later, and verifying that a file or string matches a hash someone gave you (a download checksum, an API signature, a password hash for a legacy system, that kind of thing).

Who it's for

Developers checking file integrity after a download, sysadmins verifying a checksum on a package before deploying it, students learning how hashing algorithms work, and anyone who needs an MD5 or SHA256 checksum generator without installing a command-line tool.

How to use it

• Switch between the Text and File tabs depending on what you're hashing.
• Type or paste text and every hash updates live as you type — or choose a file and it's hashed the moment it loads.
• Turn on HMAC and enter a secret key if you need a keyed hash instead of a plain digest (useful for verifying webhook signatures or API payloads).
• Paste an existing hash into the Compare field and the tool tells you instantly whether it matches any of the computed algorithms — handy for verifying a download checksum without eyeballing 64 hex characters.
• Click Copy next to any hash to grab it, or toggle uppercase output if that's the format you need.

Real-world use cases

• Verifying downloads: paste the SHA256 checksum published on a software site next to your downloaded file's hash to confirm it wasn't corrupted or tampered with.
• Debugging API signatures: generate an HMAC-SHA256 of a payload with a shared secret to check it matches what your webhook provider sent.
• Comparing two files: hash both and see if the digests match instead of diffing byte-by-byte.
• Legacy password hashing: generate an MD5 or SHA-1 hash quickly when working with an older system that still expects one.

Frequently asked questions

Is my data uploaded anywhere?

No. Every hash is computed locally in your browser using JavaScript — your text or file never leaves your device.

Why does MD5 still show up if it's "broken"?

MD5 and SHA-1 are no longer considered cryptographically secure against a determined attacker, but they're still widely used for non-security checksums (verifying a download wasn't corrupted, checking two files are identical) where collision resistance doesn't matter. SHA-256 or SHA-512 are the right choice for anything security-sensitive.

What's the difference between a hash and an HMAC?

A plain hash (MD5, SHA-256, etc.) is a one-way fingerprint of your data. An HMAC mixes in a secret key, so only someone who knows the key can generate or verify the correct HMAC — that's what APIs use to sign webhook payloads.

Can I hash a whole file, not just text?

Yes — switch to the File tab, choose a file, and it's hashed automatically the moment it finishes loading in your browser.

Does this work for checking a checksum on a large file?

Yes, the file is read and hashed locally, so it works for anything your browser can load into memory — typical downloads (installers, archives, images) hash in a second or two.