Hash Generator

A hash function turns any input into a short, fixed-length fingerprint. Change a single byte and the fingerprint changes completely, so hashes are used to check that a download arrived intact, to compare files without opening them, and to build cache keys. This tool computes MD5, SHA-1, SHA-256, SHA-384 and SHA-512 at once for text or for a file on your device. It can also compute an HMAC — a hash keyed with a secret, which services such as GitHub, Stripe and Razorpay use to sign webhooks — and compare the result with a checksum you paste.

1. Choose Text or File. Text is hashed as UTF-8, so Hindi and emoji give the same result as most command-line tools.
2. Type the text, or choose a file. All five hashes appear as soon as it has been read.
3. To check a download, paste the checksum the publisher lists. The tool works out the algorithm from its length and tells you whether it matches.
4. Turn on HMAC and enter the secret key to reproduce a webhook signature.
5. Switch to Base64 if the system you’re comparing with shows digests that way, then copy the value you need.

• MD5 and SHA-1 are broken for security: attackers can create different inputs with the same hash. Use them only to detect accidental corruption, never for signatures or passwords.
• Don’t store passwords as plain hashes of any kind. Use a slow, salted algorithm such as Argon2, scrypt or bcrypt on your server.
• Files up to 256 MB can be hashed; very large files may take a moment and need that much free memory.
• Text is hashed exactly as typed. A trailing newline added by an editor or `echo` changes the result — use `echo -n` or `printf` when comparing with a terminal.
• Everything runs in your browser using the Web Crypto API and a small built-in MD5 implementation. Files are read from your device into memory and never uploaded; text, keys and results aren’t stored. Closing the page clears them.

Usually a hidden newline. `echo "text" | sha256sum` hashes the text plus a newline; `printf "text" | sha256sum` matches this tool. Line endings (CRLF vs LF) and a byte-order mark also change the hash.

SHA-256 for anything new. It’s the default for software downloads, Git’s newer object format, and most APIs. Use MD5 or SHA-1 only when an older system requires them.

No. Hashes are one-way. Short or common inputs can be guessed by trying candidates, which is why a plain hash is not a safe way to store passwords.

Turn on HMAC, paste the exact raw request body as text, enter your webhook secret, and compare the HMAC-SHA256 with the signature header (without any “sha256=” prefix). If the body was re-formatted, the signature won’t match.