So nutzt du: Hash Generator
- Type or paste text into the box — all five hashes update as you type. Or drop a file on Hash a file.
- Choose Hex (the usual checksum format) or Base64 output, optionally uppercase.
- Tick HMAC and enter a key to compute keyed HMAC signatures instead of plain hashes.
- To verify a download, paste the published checksum into Compare — the matching algorithm is highlighted.
What is a hash function?
A cryptographic hash function turns input of any size into a fixed-size fingerprint, the digest. The same input always gives the same hash, the smallest change produces a completely different one, and it is practically impossible to reverse a hash or find two inputs with the same hash (for secure algorithms). For example, the SHA-256 of hello is 2cf24dba5fb0a30e, while Hello gives something entirely different.
Which algorithm should you use?
| Algorithm | Output | Status | Typical use |
|---|---|---|---|
| MD5 | 128 bits / 32 hex | Broken (collisions) | Non-security checksums, cache keys, legacy systems |
| SHA-1 | 160 bits / 40 hex | Broken (collisions since 2017) | Git object IDs (legacy), old certificates |
| SHA-256 | 256 bits / 64 hex | Secure | File checksums, signatures, blockchains, SRI |
| SHA-384 | 384 bits / 96 hex | Secure | TLS, Subresource Integrity (sha384-…) |
| SHA-512 | 512 bits / 128 hex | Secure | High-security applications; often faster than SHA-256 on 64-bit CPUs |
For anything security-related, use SHA-256 or stronger. MD5 and SHA-1 are still fine for detecting accidental corruption, but an attacker can craft two different files with the same MD5 or SHA-1 hash.
Verifying a file checksum
Software downloads often publish a SHA-256 checksum. Drop the downloaded file on the file area and paste the published value into Compare: a green match means the file is byte-for-byte identical to what the publisher hashed. The command-line equivalents are sha256sum file (Linux), shasum -a 256 file (macOS) and Get-FileHash file (PowerShell).
HMAC: hashing with a key
HMAC (RFC 2104) combines a hash function with a secret key. Only someone who knows the key can produce or verify the result, which makes it the standard for signing webhook payloads (GitHub, Stripe and Shopify all use HMAC-SHA256), API request signatures and HS256 JWTs. To check a webhook signature, paste the raw request body, tick HMAC, enter your signing secret and compare the result with the signature header.
Hashing is not encryption — and not for passwords
A hash cannot be “decrypted”. Sites that claim to reverse MD5 simply look the hash up in huge tables of common inputs — which is exactly why fast hashes like SHA-256 must not be used directly for storing passwords. Use a slow, salted password hash such as Argon2id, bcrypt or scrypt instead. Text here is hashed as UTF-8, matching what most programming languages do; to encode rather than hash data, see Base64. Need unique IDs instead? Use the UUID Generator.
Auch gesucht als: md5 generator, sha256 generator, sha1 hash, sha512, checksum calculator, hmac generator, file hash, md5 checksum.
Passende Tools zu: Hash Generator
- Passwortgenerator — Erstelle sichere, wirklich zufällige Passwörter oder leicht einzutippende Passphrasen – mit erweiterten Regeln: Wörter ein- oder ausschließen, Zeichen vorschreiben, zulässige Symbole auswählen, Wiederholungen und Sequenzen vermeiden.
- Bild in Base64 — Wandle ein PNG-, JPEG-, SVG-, WebP- oder GIF-Bild in eine Base64-Daten-URI mit kopierfertigem CSS und HTML um – oder füge eine Base64-Zeichenkette ein, um eine Vorschau des Bildes anzuzeigen und es herunterzuladen.
- IBAN Validator — Check whether an IBAN is valid before you send money or save it: the country, the length for that country, the account format and the mod-97 checksum.
- PKCE Generator — Test or debug an OAuth 2.0 / OpenID Connect login with PKCE.
Häufige Fragen
Can a hash be decrypted or reversed?
Is MD5 still safe to use?
Why does my hash differ from another tool?
echo without -n), Windows CRLF vs. LF line endings, or a different text encoding. This tool hashes exactly the characters you enter, encoded as UTF-8.