Hash Generator
Get the SHA-256, SHA-512 or MD5 fingerprint of any text or file — and check a download against the checksum its publisher listed, right here. Everything runs in your browser; nothing is uploaded.
Hashes
Results will appear here
Type some text or drop a file
Compare a checksum
Paste the checksum from the page you downloaded from — the whole line works too. The algorithm is worked out for you.
The algorithms, and what each is for
A hash is a fixed-length fingerprint of data of any size. The same bytes always produce the same result, and changing a single byte changes the result completely — which is what makes it the right way to check that data arrived intact.
| Algorithm | Bits | Hex length | What for |
|---|---|---|---|
| SHA-256 | 256 | 64 chars | The default choice. File checksums, git commits, API signatures — almost everything uses this. |
| SHA-512 | 512 | 128 chars | As sound as SHA-256, and often faster on 64-bit processors. |
| SHA-384 | 384 | 96 chars | What browsers expect for Subresource Integrity (SRI) attributes. |
| SHA-1broken | 160 | 40 chars | A working collision was published in 2017. Legacy interop only, such as git object IDs. |
| MD5broken | 128 | 32 chars | Broken since 2004. Kept only for checking an MD5 an older download still publishes. |
Checking a download
If the site published the file's SHA-256, drop the file here and paste the published line into the field above. If they disagree, the file was corrupted in transit — or it is not the file you were promised.
sha256sum ubuntu-24.04.isoNot for passwords
SHA-256 is built to be fast, which is exactly what someone brute-forcing a password wants. Passwords need a function that is deliberately slow: bcrypt, scrypt or Argon2. This tool does not offer them, because a password hash computed in a browser is not a safe one anyway.
bcrypt · scrypt · Argon2idFrequently asked questions
How do I check that a download was not corrupted?
Drop the file onto this page, then paste the checksum the site published into the "Compare a checksum" field. The tool identifies the algorithm from the checksum's length and tells you whether it matches. Bare hex, sha256sum output, BSD shasum output and the sha256:... form are all understood.
Can I hash passwords with SHA-256?
No. SHA-256 and SHA-512 are designed to be fast, which means a modern GPU tries billions of candidates a second. Passwords need a deliberately slow function — bcrypt, scrypt or Argon2id. Do not put anything from this tool into a password database.
Why are MD5 and SHA-1 marked "broken"?
For both, there is a known way to construct two different files with the same hash: 2004 for MD5, 2017 for SHA-1 (SHAttered). That means neither can answer "has this file been tampered with" any more. They are here only so you can check a value some older system still publishes.
What is HMAC and when do I need it?
HMAC is a hash computed with a secret key. Services like Stripe, GitHub and Telegram sign their webhook requests this way — only someone holding the key can produce the right signature. To check that an incoming request really came from them, put the payload and your signing secret in here and compare the result with the signature header.
Are my files and my key uploaded anywhere?
No. Everything is computed in your browser through the Web Crypto API — the file, the text and the HMAC key are never sent anywhere and never stored. Close the page and it is all gone.