Hash Generator (MD5, SHA-256 & more)
Updated Free mock REST & WebSocket APIs
Calculate MD5, SHA-1, SHA-256, SHA-384 and SHA-512 digests of text or any file — or an HMAC with a secret key — and verify a checksum by pasting it in. Hashing happens locally in your browser.
🔒 Hashed locally with the Web Crypto API (MD5 in JavaScript) — text, files and keys never leave your browser.
How to generate a hash
- Choose Text or File, then type your text or pick a file.
- All five hashes are calculated instantly; switch between hex and Base64 output.
- Tick HMAC to sign with a secret key, or paste an expected checksum to see which algorithm matches.
Which hash algorithm should you use?
| Algorithm | Output | Status | Use it for |
|---|---|---|---|
| MD5 | 128 bits | Broken — collisions are trivial | Detecting accidental corruption, cache keys |
| SHA-1 | 160 bits | Broken since 2017 (SHAttered) | Legacy systems only |
| SHA-256 | 256 bits | Secure | The default: checksums, signatures, HMAC |
| SHA-384 / SHA-512 | 384 / 512 bits | Secure | Higher margins; often faster on 64-bit CPUs |
Don't hash passwords with SHA-256
SHA-2 is designed to be fast, and a single GPU can try billions of guesses per second. Store passwords with a deliberately slow, salted algorithm such as Argon2id, scrypt or bcrypt instead.
Checking webhook signatures with HMAC
Many providers sign webhook payloads with HMAC-SHA256 and a shared secret. GitHub sends sha256=<hex> in X-Hub-Signature-256; Shopify sends Base64 in X-Shopify-Hmac-Sha256. Paste the exact raw request body — byte for byte, since re-serialized JSON won't match — plus your secret to compute the expected value. Capture real payloads with the webhook tester.
Related tools
Frequently asked questions
Is my text, file or key sent to a server?
No. This tool runs entirely in your browser with JavaScript, so your text, file or key never leaves your device and isn't logged or stored. You can even use it offline once the page has loaded.
Can a hash be reversed?
Not mathematically, but short or common inputs can be found by lookup in precomputed tables. That's why secrets and passwords need salts and slow algorithms.
Why doesn't my hash match the one from my terminal?
Usually a trailing newline: echo "hello" | sha256sum hashes "hello\n". Use echo -n or printf to hash the exact text.
Is there a file size limit?
Files are read into memory, so the limit is your device's RAM. Files of a few hundred megabytes work on most computers.
Your business here? Sponsor this tool from $16/week. See placements