Hash generator

No. Hashing runs in your browser: MD5 with this page’s own code, SHA-1 and SHA-2 with the browser’s WebCrypto API. A file is read from your disk and never uploaded, and nothing you type is sent anywhere or put in the address bar.

Usually a line break. echo abc | sha256sum hashes “abc” plus a newline; use printf abc or echo -n abc. Text here is hashed as UTF-8 with LF line breaks, so a file saved with Windows CRLF line breaks hashes differently from the same text pasted here. For an exact match, hash the file itself.

Not for security. Collisions, two different inputs with the same hash, can be made for both: for MD5 in seconds, for SHA-1 since 2017 (SHAttered). Use them only to catch accidental corruption, such as checking a download against a published checksum. For signatures, certificates and anything an attacker could tamper with, use SHA-256 or stronger.

Don’t store passwords as any of these hashes. They are fast, even SHA-512, so attackers can test billions of guesses a second against a leaked hash. Store passwords with a slow password hash such as Argon2id, scrypt or bcrypt, with a unique salt for each.

A hash mixed with a secret key (RFC 2104). Only someone with the key can make or check it, so it proves a message came from a key holder and wasn’t changed. Webhooks from Stripe, GitHub and Slack are signed this way, usually with HMAC-SHA256. The key here can be text, hex or Base64.

Open the File tab, choose the file and paste the published checksum into the compare box. Hex in any case, Base64, a line from sha256sum or shasum, and an SRI value such as sha384-… all work. The page says which algorithm matches, or that none does.

Up to 2 GB. The file is read in pieces with a progress bar and MD5 is worked out as it reads; WebCrypto then hashes the whole file at once, so it has to fit in memory. Above 500 MB this can be slow, especially on phones. For bigger files use shasum -a 256 file (macOS), sha256sum file (Linux) or certutil -hashfile file SHA256 (Windows).