Hash Generator
Five Digests From One Paste
This hash generator shows five digests side by side as you type. Open a file to check a download against its published checksum. Your browser does the maths, so nothing gets uploaded.
- FreePrice
- 5Algorithms
- 512 MBLargest file
- NoneUploads
Hash Generator
MD5, SHA-1, SHA-256, SHA-384 and SHA-512 at once
Nothing hashed yet.
Ready. Type some text or open a file and every hash appears together.
What A Hash Generator Gives You
A hash function reads data of any size and returns a short fingerprint of fixed length. The same input always gives the same fingerprint, down to the last character.
Change a single letter, however, and roughly half the bits of the result flip. That property turns a digest into a quick way to prove two files match exactly.
In practice this page acts as an MD5 hash generator and a SHA256 hash generator at the same time. Every one of those functions works in one direction only, though. You cannot rebuild a document from its SHA-256 value, because countless inputs share every possible output.
Your browser ships the algorithms already. MDN's reference for SubtleCrypto.digest documents the exact call this page makes.
MD5 And SHA-1 Versus The SHA-2 Family
MD5 writes 32 hex characters and SHA-1 writes 40. Researchers produced two different files with one MD5 in 2004, and Google with CWI Amsterdam did the same for SHA-1 in 2017.
So neither suits signatures or certificates any longer. Still, both remain fine for spotting accidental damage, such as a download that stopped halfway.
SHA-256, SHA-384 and SHA-512 belong to SHA-2, and nobody has found a collision in any of them. For anything new, therefore, start with SHA-256.
Situations That Call for a Secret Key
A bare hash confirms the data stayed intact, yet anybody at all can produce it. An attacker who edits a message can simply write a fresh hash beside it.
HMAC mixes a secret key into the calculation, as RFC 2104 describes. Only somebody holding the key can produce the right value, which is why webhooks from payment and code platforms sign requests this way.
Why a Plain Hash Is the Wrong Home for Passwords
SHA-256 runs fast, and speed helps attackers who guess billions of passwords a second. Instead, store passwords with a deliberately slow function such as Argon2, bcrypt or scrypt, each with a unique salt.
Using the Hash Generator in Four Moves
Four quick steps, and the first one often finishes the job. After all, every digest appears the moment you type.
- 1
Type or open a file
Paste text into the box, or press Hash a file. A file gets read as raw bytes, exactly as it sits on disk.
- 2
Choose the output
Lowercase hex matches most checksum pages. Base64 suits
integrityattributes, which usually carry a SHA-384 value in that form. - 3
Supply a secret key when the job calls for HMAC
Tick Use a secret key to switch every row to HMAC. Then paste the shared secret from your webhook settings.
- 4
Compare and copy
Paste the vendor checksum into the Denwix compare field. A green Matches badge marks the row that agrees with it.
What Sets This Hash Generator Apart
Many sites compute one algorithm per page and send your text to a server first. This one keeps everything local instead, and it shows all five together.
Five digests in one pass
Paste once and the page fills five boxes: MD5, SHA-1, SHA-256, SHA-384 and SHA-512. So you never have to guess which one a download page used.
Built on Web Crypto
The SHA family comes from your browser's own tested code. Because browsers leave MD5 out, a small version checked against the RFC 1321 test values fills that gap.
Checksums that check themselves
The compare field overlooks letter case and labels such as sha256:. As a result, a pasted value from almost any source still lines up.
HMAC for every algorithm
Webhook providers use different digests. Here one switch signs with all five, so debugging a signature takes a single paste.
Line break control
Editors often add a newline at the end of a file. Tick one box to ignore it when your hash disagrees with a terminal.
Private by design
Keys and secrets pass through this page all the time. Since the maths happens in your tab, none of them ever reaches a server.
Habits for Safe Checksums and Signatures
Hashing looks simple from the outside. Even so, a handful of habits separate a real check from a false sense of safety.
- Get the checksum from a second place. If an attacker swaps the download, they can swap the checksum on that page too. Whenever possible, take the value from a signed release note.
- Reach for SHA-256 on every new project. It runs everywhere, and every major platform supports it. Keep MD5 and SHA-1 for matching older published values only.
- Mind the invisible newline. The command
echo text | sha256sumhashes a trailing line break as well. Useecho -nwhen you want the bare text. - Compare in constant time. When your server checks an HMAC, use a timing-safe comparison. Otherwise response times can leak how many characters matched.
- Keep HMAC keys long and random. A key as long as the digest works well, such as 32 random bytes for HMAC-SHA-256. Short dictionary words fall to guessing.
- Record which algorithm you used. A hex string does not name its own algorithm. So store a label like sha256: beside it, and future you will thank you.
Three Hashing Mistakes That Cause Real Damage
Each of these passes a code review now and then. Yet each one has led to breaches or broken releases.
Plain SHA-256 for passwords
One modern GPU can test billions of SHA-256 guesses each second. Use Argon2 or bcrypt, which slow each guess down on purpose.
Hashing secrets without a key
Anyone can hash a message they altered. If the value must prove who sent it, you need HMAC or a real signature.
Trusting MD5 against tampering
Crafting two files with one MD5 takes seconds today. Therefore an MD5 match proves nothing when somebody might cheat.
Hashing Questions People Ask
Can I use this as an MD5 hash generator for files?
Yes. Press Hash a file and pick anything up to 512 MB. The MD5 row shows the same value that md5sum or certutil prints, so you can compare them directly.
Is a SHA-256 hash reversible?
No. A digest keeps too little information to rebuild the input. People crack weak passwords by guessing and hashing each guess, not by reversing the function.
Why does my shell command give a different hash?
Usually a hidden line break causes it. Many commands add a newline to the text they hash, so tick Ignore a trailing line break or use echo -n in your shell.
How does an HMAC differ from a plain hash?
A hash depends only on the data, so anyone can compute it. HMAC also depends on a secret key, which means only key holders can create or verify the value.
Which algorithm should I pick for new work?
SHA-256 suits almost every modern job, from file checks to signatures. Choose SHA-384 for subresource integrity, and keep MD5 or SHA-1 for older checksums.
Does my text or file leave my computer?
No. The page never sends what you type or open. Your browser reads the bytes and computes every digest in memory, and nothing gets logged.
Tools To Use Alongside Hashing
A digest rarely stands alone in a workflow. These three handle the steps around it, all without an account.
Base64 Encoder and Decoder
Turn a Base64 signature into bytes, or back again.
Open tool →Password Generator
Make a long random secret for your HMAC key.
Open tool →JSON Formatter
Read the webhook payload you just verified.
Open tool →
Ready To Check A Checksum?
Open the file, paste the published value, and look for the green badge. The hash generator costs nothing and keeps every byte on your device.