Hash Generator
MD5, SHA-1, SHA-256, SHA-384, SHA-512 — plus HMAC. Hash text or files entirely client-side.
About the Hash Generator
The Hash Generator turns any text or file into a fixed-length fingerprint using MD5, SHA-1, SHA-256, SHA-384, or SHA-512. A hash is a one-way checksum: the same input always produces the same string, and changing one character produces a completely different one. You use it to verify a download matches its published checksum or to spot whether two blobs of data are identical.
Type or paste into the text box and all five hashes compute live as you go, with no button to press. Pick a file instead and it reads the bytes in your browser and hashes those directly, showing the file name and size in KB. SHA hashes run on the Web Crypto API built into your browser; MD5 uses the spark-md5 library. Every result is lowercase hexadecimal with its own Copy button.
Hashing uses your browser's built-in Web Crypto engine, so it is free, needs no account, and works offline. Nothing you type or select is uploaded to a server, which matters when you hash a password, an internal document, or an API secret. Because the work happens locally you can use it offline once the page has loaded, with no rate limits.
How to use the Hash Generator
- 1Type or paste your content into the Text to hash box to see MD5, SHA-1, SHA-256, SHA-384, and SHA-512 update instantly.
- 2To hash a file instead, use the file picker under "...or hash a file" and select any file from your device.
- 3Read the results in the list below, where each algorithm name sits above its hex digest.
- 4Click the Copy button next to any hash to put that single value on your clipboard.
- 5For a keyed hash, scroll to the HMAC panel and choose HMAC-SHA-1, HMAC-SHA-256, or HMAC-SHA-512.
- 6Enter a Secret key and a Message, then press Compute HMAC and copy the signature it returns.
What you can use it for
Verify a download
You grabbed an installer or ISO and the project lists a SHA-256 checksum. Pick the file here, read the SHA-256 line, and compare it against the published value. A match means the bytes arrived intact and untampered.
Sign an API request
A payment or webhook provider asks you to sign a request body with HMAC-SHA-256 and a shared secret. Paste the body as the Message, your secret as the key, and Compute HMAC to produce the exact signature to send.
Detect changed data
You have two config files or two strings that look identical. Hash each with SHA-256 and compare the digests. Identical hashes mean identical content; a single different byte flips the whole result, so differences never hide.
What a hash actually gives you
A cryptographic hash maps input of any length to a fixed-size output: 128 bits for MD5, 160 for SHA-1, and 256, 384, or 512 for the SHA-2 family shown here. That is why a one-line note and a gigabyte file produce a digest of the same length. The mapping is deterministic and one-way, so you cannot reverse a digest back into its input, and a one-character change cascades into a totally different string.
HMAC adds a secret key. A plain SHA-256 of a message can be recomputed by anyone, so it proves the content but not who produced it. HMAC-SHA-256 folds your shared key into the calculation, so only someone holding the same key can produce a matching signature. That is why webhooks and API providers sign requests with HMAC.
Frequently asked questions
Does the text or file I hash leave my device?
No. Text hashing uses your browser's built-in Web Crypto engine, and files are read and hashed in memory on your machine. Nothing leaves the page, so hashing a secret or a private document does not expose it. Once the page has loaded it even works offline.
Why does the HMAC panel only list three algorithms?
The HMAC section offers HMAC-SHA-1, HMAC-SHA-256, and HMAC-SHA-512. MD5 and SHA-384 appear in the plain hash list at the top but not for HMAC. SHA-256 is selected by default and is the right choice for almost every signing scheme you will meet.
What character encoding is used for text?
Text is encoded as UTF-8 before hashing, using the browser's TextEncoder, and the HMAC key and message use the same encoding. Hash the same string in another UTF-8 tool and you get the same digest; a tool using a different encoding will not match.
Should I still use MD5 or SHA-1?
Only for compatibility, never for security. Both are fine for matching an old published checksum or spotting accidental corruption, but both have known collision attacks. Do not use them to protect passwords or sign data; reach for SHA-256 or stronger when security actually matters.
Can I hash a very large file?
The tool reads the whole file into memory before hashing, so a multi-gigabyte file can be slow or run out of memory depending on your device and browser. For everyday documents, archives, and installers it is fast. Very large files are the edge case to watch.