Hash generator

Type something, or drop a file, and read its fingerprint. Hashing runs in your browser. The file is not uploaded.

SHA-256 TEXT 0 BYTES

Check it against a hash you were given

Paste the expected value. Hex or base64, any case, spaces and colons ignored.

Every algorithm at once

The same input through all six. Click a row to copy it.

    Algorithm
    Show it as
    Sign it with a key (HMAC)

    What you are looking at

    A hash is a fixed-size fingerprint of any input. Change one bit of the input and about half the bits of the digest flip, which is why the whole line churns when you type a single letter. You cannot run it backwards: the digest tells you nothing about the input except whether another input is the same one.

    Text is hashed as UTF-8 bytes, with no newline added. That is why echo abc | sha256sum on your machine gives a different answer to the one here: echo appends a newline, so it hashes four bytes, not three. Use printf abc | sha256sum and they agree.

    Which one to use

    SHA-256 is the everyday choice: checksums, content addresses, signatures, anything new. SHA-512 is the same family with a wider state, and is often faster on 64-bit machines; SHA-384 is SHA-512 truncated. All three come from your browser's Web Crypto, the same code it uses for TLS.

    SHA-1 has had practical collisions since 2017 and is retired for certificates and signatures, but you still meet it in git and old checksum files. MD5 has been broken since 2004 and is here so you can check a download against a legacy .md5 file, nothing more. CRC32 is not a hash at all: it is a 32-bit checksum that catches accidental damage and is trivial to forge. MD5 and CRC32 are done in plain JavaScript on this page.

    Files

    A dropped file is read in 4 MB pieces, so the page never asks the browser for more than it has. SHA-256 streams through those pieces at any size. SHA-1, SHA-384, SHA-512 and MD5 need the whole file in memory before Web Crypto can digest it, so for those the limit here is 512 MB. Above that, pick SHA-256 or CRC32, which stream. Nothing is uploaded: the file is opened by your browser, hashed by your browser, and closed.

    HMAC and comparing

    HMAC mixes a secret key into the hash so only someone holding the key can produce or check the value. Webhooks, signed URLs and API request signing use it. Turn it on, type the key, and the digest becomes HMAC over the same input. It is available for the SHA family only.

    The compare field just tells you whether the two values are the same bytes. Hex is matched case-insensitively with spaces and colons ignored; base64 is matched as typed.

    Nothing you type or drop is sent, logged or stored. The only thing this page records is that a hash was made, which algorithm, and whether it was text or a file.