Free Hash Generator
Compute MD5, SHA-1, SHA-256, SHA-384 and SHA-512 hashes of any text or file. HMAC mode with a secret key, hex and Base64 output, and a verify field to compare against known hashes — all in your browser.
Your Input
Hash Results
No hash yet
Type in the left panel or drop a file to see hashesWhat Is a Hash Function?
A hash function (also called a digest or checksum) takes an input of any size — a single character, a 4 GB video file — and produces a fixed-length string of bytes. The same input always produces the same hash, and a tiny change in input produces a completely different output. That combination makes hashes useful for a huge range of tasks.
Three properties define a cryptographic hash function:
- Deterministic — the same input always produces the same output.
- One-way — you cannot work backwards from a hash to the original input.
- Collision-resistant — it is computationally infeasible to find two different inputs that produce the same hash.
The five algorithms in this tool
| Algorithm | Output size | Status | Use for |
|---|---|---|---|
| MD5 | 128 bits · 32 hex chars | ❌ Broken | Legacy checksums, compatibility only |
| SHA-1 | 160 bits · 40 hex chars | ❌ Deprecated | Git objects (legacy), nothing security-critical |
| SHA-256 | 256 bits · 64 hex chars | ✅ Secure | File integrity, signatures, blockchains |
| SHA-384 | 384 bits · 96 hex chars | ✅ Secure | High-assurance applications |
| SHA-512 | 512 bits · 128 hex chars | ✅ Secure | Long-term integrity, password hashing inputs |
The SHA-2 family (SHA-256, SHA-384, SHA-512) is the current standard. MD5 and SHA-1 are included here for compatibility and verification of legacy checksums, not for new security work.
Hex vs Base64 output
| Format | Looks like | Best for |
|---|---|---|
| Lowercase hex | 9f86d081884c7d65… | Checksums, most tooling, default choice |
| Uppercase hex | 9F86D081884C7D65… | Windows certutil, some legacy tools |
| Base64 | n4bQgYhMfW… | Shorter strings, embedding in JSON or HTTP headers |
All three formats represent the same bytes. Hex is the conventional choice and is what you will find in checksum files published by software vendors. Base64 is about 25% shorter but harder to compare visually.
What is HMAC?
HMAC (Hash-based Message Authentication Code) is a construction that combines a hash function with a secret key. The result is a hash that can only be produced by someone who knows the key — which means you can prove both who sent a message and that it has not been tampered with.
Plain hashes prove only integrity. HMACs prove integrity and authenticity. Common uses:
- API request signing — AWS Signature V4, Stripe, GitHub webhooks.
- JWT signing — HS256, HS384 and HS512 are all HMAC-based.
- Webhook verification — confirming that a POST came from the service you expect.
- Cookie tampering detection — signing a session token so a client cannot modify it.
Common use cases
Verify Downloads
Confirm a file matches the SHA-256 published by the vendor.
Sign API Requests
Generate HMAC signatures for AWS, Stripe and webhooks.
Detect File Changes
Hash a config file, then re-hash later to spot edits.
Store Password Digests
Hash a secret before storing it in a database or cache.
Deduplicate Data
Identify identical files by comparing hashes, not contents.
Cache Keys
Hash a request body to produce a stable cache key.
Short URLs
Turn long input into a fixed-length identifier.
Legacy Compatibility
Reproduce MD5 hashes expected by old systems.
Privacy and security
This hash generator runs entirely in your browser. The SHA family and all HMAC operations use the browser's native crypto.subtle API. MD5 is implemented in pure JavaScript. Nothing is uploaded, stored or transmitted — safe for API secrets, private keys, sensitive documents and anything else you would not want on someone else's server.