About Hash Generator
Compute MD5, SHA-1, SHA-256, SHA-384, and SHA-512 simultaneously from any string or file. HMAC mode lets you sign with a shared secret. Files up to about 1 GB are read in chunks so the browser never blocks. Hashes are computed via <code>SubtleCrypto</code> — your data does not leave the page.
What a hash is
A cryptographic hash maps any input — a byte, a string, a 4 GB ISO — to a fixed-length output that is practically impossible to reverse. Same input → same hash, every time. Two different inputs → with overwhelming probability, different hashes. This single property powers integrity checks, password storage, content-addressable storage, blockchain, and most digital signatures.
Which algorithm?
| Algorithm | Output | Use case |
|---|---|---|
| MD5 | 128 bits | Legacy file checksums, ETags. Not for security. |
| SHA-1 | 160 bits | Git commit SHAs (transitioning to SHA-256). Not for security. |
| SHA-256 | 256 bits | The modern default. TLS, signatures, blockchain, JWT HS256. |
| SHA-384 | 384 bits | Web Crypto-friendly, used in JWT HS384, some TLS suites. |
| SHA-512 | 512 bits | Higher security margin, slower on 32-bit, common in Linux shadow. |
For new code, default to SHA-256. It is fast on every modern CPU, supported everywhere, and provides a security margin that survives until quantum threats become real.
How to use this tool
Hash a string. Paste into the input. All five hashes appear simultaneously — one click copies any.
Hash a file. Drag and drop. The file streams through chunks; a progress bar shows the hash building. Useful for verifying a download against the publisher’s posted checksum.
HMAC mode. Toggle on, paste the shared secret, paste the message. Computes HMAC-SHA-256/384/512 in parallel. Used for webhook verification (Stripe, GitHub, Shopify) and API request signing (AWS SigV4, HMAC bearer auth).
Common workflows
Verify a software download. The publisher posts SHA-256. You drop the file here, compare. Mismatch means the download corrupted or you grabbed a tampered mirror.
Sign a webhook. Implementing a webhook receiver. Compute the HMAC locally with the same secret, compare against the X-Signature header. Match → the request really came from your sender.
Build a deterministic ID. Hash a (user_id + timestamp + nonce) tuple to produce a stable opaque identifier. SHA-256 is plenty; truncate to 128 bits if you need shorter output.
Why local hashing matters
A file hash often is the entire reason you cared — proving the download is the file the author signed. Sending it through a remote hashing site defeats the purpose: a malicious server could lie about the hash. Local hashing closes that gap. Your file, your CPU, the same mathematical answer everyone else’s tool will produce.
Frequently asked questions
Is MD5 still safe to use?
Why would I need every hash at once?
How does file hashing work?
SubtleCrypto.digest. The browser stays responsive throughout — even 1 GB videos hash without locking the UI.What is HMAC?
hash(message) you compute hash(secret + message) in a way that resists length-extension attacks. Used everywhere a server needs to verify a request was signed by a party holding the shared secret — webhooks, API auth, cookie signatures.Why are my SHA-256 results different from <code>shasum</code>?
echo "hello" appends a newline; echo -n "hello" does not. Paste with the trailing newline if your file has one — match the byte sequence and the hashes will agree.Are uploads encrypted?
Related tools
Last updated: 2025-01-15