Generate MD5, SHA-256 and other hashes.
Hash text or a file with MD5, SHA-1, SHA-256, SHA-384, SHA-512 or CRC-32, add a secret key for HMAC, and check a download against its published checksum.
Runs in your browserNothing uploaded or storedFree, no sign-up
Your text
Drop a file hereor use “Choose file”. Files are never uploaded.
Bytes0
Hashes
MD5
–MATCHSHA-1
–MATCHSHA-256
–MATCHSHA-384
–MATCHSHA-512
–MATCHCRC-32
–MATCHHashes update as you type
Which hash should I use?
Checking downloads
Compare a file's SHA-256 with the one the publisher lists to confirm it was not corrupted or tampered with.
Signing and APIs
Use HMAC-SHA-256 with a secret key to sign requests and webhooks. Both sides compute it and compare.
Passwords
Never store passwords with a plain hash. Use bcrypt, scrypt or Argon2, which are designed to be slow and salted.
MD5 and SHA-1
Both are broken for security. They are still fine for quick checksums, cache keys and de-duplicating files.
Questions people ask
What is a hash?
A hash is a fixed-length fingerprint of some data. The same input always gives the same hash, a tiny change gives a completely different one, and you cannot work backwards from the hash to the input.
Is MD5 safe to use?
Not for security. MD5 and SHA-1 can be forged, so do not use them for passwords or signatures. They remain handy for non-security checksums such as spotting duplicate files. Use SHA-256 or better when it matters.
What is HMAC?
HMAC mixes a secret key into the hash, proving both that the data was not changed and that it came from someone who knows the key. It is widely used to sign API requests and webhooks.
How do I check a downloaded file?
Choose the file, then paste the checksum from the download page into “Compare”. If it matches, the row turns green. Match against the same algorithm the publisher used, usually SHA-256.
Is my text or file uploaded?
No. Everything is hashed in your browser. MD5 and CRC-32 are calculated by the page itself, and the SHA family uses your browser's built-in crypto. A file never leaves your device.
Why are the SHA hashes missing?
Browsers only provide the SHA functions on secure pages (HTTPS or localhost). On an insecure connection MD5 and CRC-32 still work, but the SHA rows show a note.