Encoders & Utilities

Hash Generator

Compute MD5, SHA-1, SHA-256, SHA-384, SHA-512, and HMAC for text or files. Browser-side hashing for files up to 100 MB.

Algorithms

MD5 SHA-1 SHA-256 SHA-384 SHA-512

UPPERCASE

About this tool

Hash Generator computes cryptographic hashes for text or files entirely in your browser. Supported algorithms cover the full SHA-2 family (SHA-256, SHA-384, SHA-512) via the Web Crypto API, plus the historical MD5 and SHA-1 via a small JS implementation (kept for verification of legacy outputs). HMAC variants are available for all SHA-2 algorithms — paste a key and the message, get the keyed-hash output ready for signature verification.

For files (drag-and-drop), the file is streamed through the hash function in chunks — so you can hash a 100 MB ISO in a few seconds without sending it anywhere. The output can be displayed as lowercase or uppercase hex, or as Base64 (useful for HTTP authentication and JWT signatures). Multiple algorithms can be selected at once; the file is streamed once and the hashes are computed in parallel.

When to use this tool

Verifying downloads. Compare the SHA-256 of a file against the project's published checksum to detect tampering or corruption.
Generating an integrity hash. Pre-compute SHA-256 for an asset before adding the integrity="sha256-..." attribute on a <script> tag.
Signing API requests. Compute HMAC-SHA-256 for AWS-style request signing without writing a script.
Quick deduplication. A SHA-1 fingerprint per file is plenty for "are these two files identical?" checks.

When NOT to use MD5 or SHA-1

Both are cryptographically broken. MD5 collisions have been demonstrated since 2008; SHA-1 since 2017 (the SHAttered attack). Use them only for legacy verification — never for new signatures, password hashing, or anti-tampering. For passwords specifically, use bcrypt, scrypt, or Argon2 instead of any plain hash; these are deliberately slow and memory-hard to defeat brute-force attacks.

Frequently asked questions

Should I use MD5 for password storage?

Absolutely not. Plain hashes (MD5, SHA-1, even SHA-256) are designed to be fast, which is the opposite of what you want for passwords — fast means attackers brute-force them. Use a deliberately slow, memory-hard function like bcrypt, scrypt, or Argon2id. Most modern frameworks bundle one as the default password hasher.

Is browser hashing as accurate as command-line tools?

Yes — for SHA-256 and the SHA-2 family the output is bit-for-bit identical to sha256sum on Linux or shasum -a 256 on macOS, because both call the same fundamental algorithm. Our MD5 and SHA-1 implementations are also widely tested. The only difference vs CLI is performance: native code is faster on huge files, but the browser handles 100 MB comfortably.

What is HMAC?

A keyed hash — combines a secret key with the input so the output cannot be forged by anyone who does not know the key. Used for API request signing (AWS Signature V4 is HMAC-SHA-256), JWT signatures with the HS256 algorithm, and webhook validation. The same algorithm with different keys produces unrelated outputs, which is what makes it a signature rather than a fingerprint.

Why does my hash differ from another tool?

Usually because of line endings or encoding. hello with a trailing newline hashes differently from hello without. UTF-8 vs UTF-16 encoded text differs. CRLF vs LF line endings differ. Make sure both tools are reading the exact same bytes — the easiest check is to hash a file (not a string) and confirm both tools agree on the byte sequence.