Hash Generator
Input
Hash Results
MD5128-bit
—
SHA-1160-bit
—
SHA-256256-bit
—
SHA-384384-bit
—
SHA-512512-bit
—
Verify

Related Tools

See all ->
UUID / ULID / NanoIDv4, v7, v1, ULID, NanoIDPassword GeneratorSecure & entropy-scoredBase64 Encoder/DecoderEncode & decode instantlyJWT DecoderDecode & verify tokensURL Encoder/DecoderPercent-encode & decodeRegex TesterTest & debug patternsJSON FormatterFormat & validateDiff CheckerCompare text & code

Hash Generator Online Free — MD5, SHA-256, SHA-512 & HMAC from Text or File

Updated May 14, 2026
Share & Support

What's included

Features

Five hash algorithms at once — MD5, SHA-1, SHA-256, SHA-384, SHA-512 computed simultaneously
Live text hashing — all five hashes update in real time as you type
File hashing — drag & drop or upload any file, any size, computed entirely in the browser
HMAC mode — generate authenticated message authentication codes with a secret key (SHA-1/256/384/512)
Hash verification — paste an expected hash to instantly confirm match or mismatch with auto-algorithm detection
Uppercase/lowercase toggle — switch hex output between lowercase and uppercase for any convention
Copy individual algorithm hash or copy all results formatted in one click
WebCrypto API for SHA algorithms — hardware-accelerated native browser cryptography
100% client-side — no text, file content, or HMAC secret key is ever uploaded to any server; encode binary data with our Base64 Encoder / Decoder
Works offline once the page has loaded

About this tool

Generate MD5, SHA-256, SHA-512 Hashes Online — Verify File Checksums & HMAC

You need to generate a SHA-256 hash of some text for an API signature. Or you downloaded a file and want to verify its checksum matches what the publisher listed. Or you need to compute an HMAC-SHA256 signature with a secret key to debug a webhook. Type or upload your data here and get all five hash algorithms at once — instantly, in your browser.

This tool computes MD5 (32 hex chars), SHA-1 (40 chars), SHA-256 (64 chars), SHA-384 (96 chars), and SHA-512 (128 chars) simultaneously as you type — no button click, no server round-trip. For files, drag and drop any file and all five hashes appear within a second. Nothing is uploaded. The SHA algorithms use the browser's native WebCrypto API (hardware-accelerated); MD5 uses a JavaScript implementation.

Hash verification: Paste the expected checksum from the download page into the Verify field. The tool reads the hash length to auto-detect the algorithm and shows a green checkmark (match) or red mismatch indicator instantly. You don't need to specify whether it's MD5 or SHA-256 — the length tells the tool which algorithm it is.

HMAC mode: Enable HMAC and enter a secret key. HMAC-SHA256 combines the hash function with your key so only someone who knows the key can reproduce the output. This is the signing mechanism behind AWS Signature Version 4, Stripe webhook verification, GitHub webhook validation, and JWT HS256/HS512 tokens.

MD5 is the odd one out under the hood: because the WebCrypto SubtleCrypto API deliberately does not expose MD5 as a supported digest algorithm — one practical consequence of it being considered cryptographically broken — this tool implements the full MD5 algorithm from scratch in plain JavaScript, running the standard 64-round Merkle–Damgård construction over four working registers exactly as the original 1992 specification defines it. The four SHA variants, by contrast, call crypto.subtle.digest() directly, so they run as native, hardware-accelerated code in the browser rather than interpreted JavaScript — part of why hashing a large file feels effectively instant once it is read into memory. HMAC mode excludes MD5 for the identical reason: SubtleCrypto only supports HMAC construction over its own built-in digest algorithms, so MD5 has no native HMAC path to hook into. The Verify field does not actually guess your algorithm from the pasted string's length — it normalizes your input to lowercase and directly compares it against all five currently-computed hash values at once, so whichever algorithm produces an exact match is reported by name; this is a more forgiving check than a length-based guess, since it still works correctly even if two algorithms happened to share a digest length.

Hashes are one-way: you cannot reverse a hash to get the original input. They are used to verify data hasn't changed (same input always produces the same hash), and to detect tampering (even a single changed character produces a completely different hash). Never use MD5 or SHA-1 for security-critical applications — they're cryptographically broken. Use SHA-256 or higher.

Step by step

How to Use

  1. 1
    Choose Text or File input modeUse the Text / File toggle in the header to select your input type. In Text mode, type or paste any string — all five hashes (MD5, SHA-1, SHA-256, SHA-384, SHA-512) update live as you type with no button press needed. In File mode, drag and drop any file onto the upload zone or click to browse — all five hashes appear within a second as soon as the file is read into memory. Nothing is uploaded to any server in either mode.
  2. 2
    Enable HMAC mode for authenticated signatures (optional)Toggle HMAC in the header to switch to HMAC (Hash-based Message Authentication Code) mode. A secret key input appears — enter your signing key. HMAC results update for SHA-1, SHA-256, SHA-384, and SHA-512 as you type in the input area. MD5 is excluded from HMAC mode because it is cryptographically broken. Use this to generate and verify API request signatures (AWS, Stripe, GitHub webhooks, JWT HS256).
  3. 3
    Read your hash resultsEach hash algorithm shows its result in its own row — MD5 (32 hex chars), SHA-1 (40), SHA-256 (64), SHA-384 (96), SHA-512 (128). Toggle Uppercase to switch between lowercase hex (the Linux/web convention) and uppercase hex (used by some Windows tools and API specifications). Both representations encode the same value — only the character case differs.
  4. 4
    Copy individual or all hashesClick the copy icon next to any algorithm row to copy just that hash. Click Copy all in the results header to get all five hashes formatted with algorithm labels — useful for sharing checksums in release notes or documentation. The confirmation tick disappears after 1.8 seconds.
  5. 5
    Verify a hash against an expected checksumPaste the expected hash into the Verify field at the bottom of the results panel. The tool reads the hash length to auto-detect the algorithm (32 chars = MD5, 40 = SHA-1, 64 = SHA-256, 96 = SHA-384, 128 = SHA-512) and compares it against your computed result. A green checkmark confirms a match; red "No match" means the data or algorithm differs.

Real-world uses

Common Use Cases

🔒
Verify a downloaded file's checksum before installing it
Drop the downloaded ISO, installer, or archive onto the File input. The SHA-256 hash appears in a second. Paste the checksum from the software publisher's download page into the Verify field — green means the file is intact and authentic, red means it was corrupted or tampered with.
🔑
Generate an HMAC-SHA256 signature to debug API authentication
Enable HMAC mode, enter your signing secret, and type the request payload. The HMAC-SHA256 output matches what Stripe, AWS, GitHub webhook, and JWT HS256 libraries produce — use it to verify your API signing logic is correct without writing test code. Decode the resulting JWT with our JWT Decoder.
🪙
Manually verify a JWT HS256 or HS512 signature
Concatenate the JWT's header and payload with a dot (header.payload), enter it as the message, enter your JWT secret as the HMAC key, and compare the HMAC-SHA256 output against the JWT's signature segment. Confirms whether the secret is correct without running server code.
🗃️
Create SHA-256 fingerprints for content deduplication
Hash files or text blocks to generate unique content identifiers. Two inputs with the same SHA-256 hash are, for all practical purposes, identical — the foundation of hash-based deduplication in storage systems, caches, Git object stores, and content-addressable filesystems. Generate secure identifiers to store with our Password Generator.
📦
Generate checksums for build artifacts and deployment binaries
Hash build artifacts, Docker layers, NPM packages, and deployment binaries to pin exact versions in CI/CD pipelines. Compare hashes across build environments to detect supply chain tampering or environment-specific differences.
🛡️
Understand why MD5 is no longer safe for passwords
Hash a simple password with MD5 and SHA-256 and compare the output instantly. MD5's speed (millions per second) is exactly why it's broken for passwords. Understanding this makes the case for bcrypt and Argon2 — intentionally slow algorithms with built-in salting.

Got questions?

Frequently Asked Questions

Type or paste your text into the input area. All five hash algorithms update in real time — SHA-256 appears immediately as you type. No button click needed. The SHA-256 hash is the 64-character hex string in the SHA-256 row. Click the copy icon next to it to copy just that hash, or use Copy all to get all five formatted together.

Switch to File mode using the toggle at the top. Drop the file onto the upload area or click to browse — the tool reads the file in your browser and displays all five hash values immediately. Find the checksum published by the software vendor (SHA-256 or MD5, typically listed on the download page or in a .sha256 file). Paste it into the Verify field. The tool reads the hash length to auto-detect the algorithm and shows a green checkmark for a match or red mismatch indicator instantly.

Enable HMAC mode using the toggle in the header. An HMAC secret key input appears — enter your signing key. Type or paste your message (the payload or string to sign) in the text area. The HMAC-SHA256 result appears in the SHA-256 row. This output matches the HMAC-SHA256 implementation in all standard libraries and is compatible with AWS Signature Version 4, Stripe webhook signatures, GitHub webhook validation, and JWT HS256 signing.

MD5 (32 chars) and SHA-1 (40 chars) are both cryptographically broken — intentional collisions can be generated in seconds. Do not use either for security purposes. SHA-256 (64 chars) is the current industry standard for all new security applications: file integrity, API signing, digital signatures, and certificate fingerprints. SHA-512 (128 chars) provides an extra security margin — useful for high-security applications or hardware that runs 64-bit operations faster. Use SHA-256 as your default for everything except legacy systems that require MD5 or SHA-1.

For detecting accidental corruption — yes, MD5 is fine. If you just want to confirm a file wasn't corrupted during download and you're not worried about a motivated attacker, MD5 works. But for security-critical integrity checks — verifying that a file wasn't deliberately tampered with — MD5 is broken. A skilled attacker can engineer two different files with the same MD5 hash. Use SHA-256 for all security-sensitive integrity verification.

Yes, large files work. The File mode uses the FileReader API to read the file as an ArrayBuffer and passes it to the WebCrypto SubtleCrypto.digest() method — no size limit is imposed by this tool. WebCrypto is hardware-accelerated in all modern browsers. A few-hundred-megabyte file typically hashes in under a second. Very large files (multiple GB) may take a few seconds as the file is read into browser memory. The UI shows a loading state so you know it's working. Nothing is uploaded — the file stays entirely in your browser.

No. Hash functions are one-way by design. Given a hash output, it is computationally infeasible to reconstruct the input — this is called pre-image resistance. You cannot "decode" a SHA-256 hash. The only way to find the original input is to hash candidate values and compare — which is why dictionary attacks and rainbow tables work against weak passwords. For strong random passwords and data, hashes are irreversible in practice.

Yes — 100% private. All hashing runs in your browser using the native WebCrypto API for SHA algorithms and a JavaScript implementation for MD5. Nothing is transmitted to any server. Safe for API secret keys, file contents, credentials, or any data you would not want to share with a third party. The tool also works fully offline once the page has loaded.