How to use the Hash Generator
- Type or paste text into the box — all five hashes update as you type. Or drop a file on Hash a file.
- Choose Hex (the usual checksum format) or Base64 output, optionally uppercase.
- Tick HMAC and enter a key to compute keyed HMAC signatures instead of plain hashes.
- To verify a download, paste the published checksum into Compare — the matching algorithm is highlighted.
What is a hash function?
A cryptographic hash function turns input of any size into a fixed-size fingerprint, the digest. The same input always gives the same hash, the smallest change produces a completely different one, and it is practically impossible to reverse a hash or find two inputs with the same hash (for secure algorithms). For example, the SHA-256 of hello is 2cf24dba5fb0a30e, while Hello gives something entirely different.
Which algorithm should you use?
| Algorithm | Output | Status | Typical use |
|---|---|---|---|
| MD5 | 128 bits / 32 hex | Broken (collisions) | Non-security checksums, cache keys, legacy systems |
| SHA-1 | 160 bits / 40 hex | Broken (collisions since 2017) | Git object IDs (legacy), old certificates |
| SHA-256 | 256 bits / 64 hex | Secure | File checksums, signatures, blockchains, SRI |
| SHA-384 | 384 bits / 96 hex | Secure | TLS, Subresource Integrity (sha384-…) |
| SHA-512 | 512 bits / 128 hex | Secure | High-security applications; often faster than SHA-256 on 64-bit CPUs |
For anything security-related, use SHA-256 or stronger. MD5 and SHA-1 are still fine for detecting accidental corruption, but an attacker can craft two different files with the same MD5 or SHA-1 hash.
Verifying a file checksum
Software downloads often publish a SHA-256 checksum. Drop the downloaded file on the file area and paste the published value into Compare: a green match means the file is byte-for-byte identical to what the publisher hashed. The command-line equivalents are sha256sum file (Linux), shasum -a 256 file (macOS) and Get-FileHash file (PowerShell).
HMAC: hashing with a key
HMAC (RFC 2104) combines a hash function with a secret key. Only someone who knows the key can produce or verify the result, which makes it the standard for signing webhook payloads (GitHub, Stripe and Shopify all use HMAC-SHA256), API request signatures and HS256 JWTs. To check a webhook signature, paste the raw request body, tick HMAC, enter your signing secret and compare the result with the signature header.
Hashing is not encryption — and not for passwords
A hash cannot be “decrypted”. Sites that claim to reverse MD5 simply look the hash up in huge tables of common inputs — which is exactly why fast hashes like SHA-256 must not be used directly for storing passwords. Use a slow, salted password hash such as Argon2id, bcrypt or scrypt instead. Text here is hashed as UTF-8, matching what most programming languages do; to encode rather than hash data, see Base64. Need unique IDs instead? Use the UUID Generator.
Tools that pair well with the Hash Generator
- URL Encode / Decode — Percent-encode text for safe use in URLs, decode encoded strings back to readable text, and break any URL down into its parts and query parameters.
- Unix Timestamp Converter — See the current Unix time live, convert any epoch timestamp (seconds, milliseconds, micro- or nanoseconds) to a date in any time zone, and turn dates back into timestamps.
- HTML Entity Encoder — Escape < > & " so text is safe to show in HTML, convert accents and symbols to named or numeric entities, or decode entity-filled HTML back to plain text.
Frequently asked questions
Can a hash be decrypted or reversed?
Is MD5 still safe to use?
Why does my hash differ from another tool?
echo without -n), Windows CRLF vs. LF line endings, or a different text encoding. This tool hashes exactly the characters you enter, encoded as UTF-8.