Hash generator
MD5 and SHA checksums of text or files, with an HMAC key and a compare field.
UTF-8 text. With a key, every result is an HMAC.
Files stay on your device. Nothing is uploaded.
Up to 20 local files of any size, read in chunks. Press Run to hash them.
Hashes
Hashes appear here as you type. Files are hashed after Run.
Case, surrounding spaces and colons between bytes are ignored.
Text: up to 1 MiB (1,048,576 UTF-8 bytes); above 200 KB it runs in a worker. Files: any size, up to 20 per run, read in chunks.
MD5 and SHA-1 detect accidental changes, not tampering. Nothing is uploaded, saved or added to the page URL.
Related tools
-
Base64 encoder and decoder
Convert text or a local file to Base64 and back, without uploads. -
UUID generator
Create secure random v4 or timestamp-based v7 UUIDs in batches. -
JWT Decoder
Read token contents and dates. Signatures are not verified. -
Password generator
Random passwords and word passphrases, with the strength shown in bits.
Compute the hash of any text or local file and check it against a value you were given. Select MD5, SHA-1, SHA-256, SHA-384 and SHA-512 in one pass, add an HMAC key when an API expects a signed message, and read the result as hex or Base64. Files of any size are read in chunks inside a background worker with a progress bar per file, so a large download can be verified without freezing the page. The compare field says in words whether the pasted checksum matches. Nothing is uploaded, and neither the input nor the key is saved.
How to use
- Choose Text or Files, then type or paste text, or drop one or more files.
- Switch algorithms on or off; text hashes as you type, files after Run.
- Enter an HMAC key to sign the input, and pick hex, uppercase hex or Base64 output.
- Paste the expected checksum into the compare field to see whether it matches.
- Copy one hash, or copy all of them with Ctrl/⌘+Shift+C. Ctrl/⌘+Enter runs.
What it handles
- One read of the input for all five: MD5, SHA-1, SHA-256, SHA-384 and SHA-512.
- Text is hashed as UTF-8, so accents, emoji and other scripts hash exactly as their bytes.
- Files of any size stream through a worker with per-file progress and a Cancel button.
- HMAC for every algorithm; long keys are hashed first, as RFC 2104 requires.
- The compare field ignores case, surrounding spaces and byte separators such as colons.
- Every edit, Clear or Cancel discards pending work, so an older result can never reappear.
FAQ
Is my file uploaded to compute the hash, and is there a size limit?
No. The file is read in chunks on your device inside a Web Worker; only the digests exist in memory, and nothing is sent to a server, saved in browser storage or added to the page address. Files have no size limit, up to 20 per run. Text is limited to 1 MiB of UTF-8; above 200 KB it is hashed in the worker. On a desktop expect roughly 200 MB/s for SHA-256, 50 MB/s for SHA-512 and about 20 MB/s with all five selected.
Is MD5 safe for passwords or signatures?
No. MD5 and SHA-1 are broken for security: different inputs can be crafted to produce the same hash, and fast unsalted hashes of passwords can be reversed with precomputed tables. Use them only to detect accidental corruption, such as checking a download against a published checksum. Passwords need a slow, salted algorithm such as bcrypt, scrypt or Argon2; signatures need SHA-256 or stronger inside a proper signature scheme.
Why is my hash different from another site or from the terminal?
The bytes differ, not the algorithm. Common causes: a trailing newline added by echo, Windows CRLF instead of LF line endings, a byte order mark, a different text encoding such as UTF-16, or Unicode spelled two ways. The letter é as one precomposed code point and as e plus a combining accent are different bytes and hash differently. Hash the file itself, or normalise the text first, and compare again.
What is HMAC and when do I need it?
HMAC mixes a secret key into the hash, so only someone who knows the key can produce or verify the value. APIs use it to sign webhooks and requests, for example HMAC-SHA-256 over the request body. Enter the key exactly as the service documents it; this tool treats it as UTF-8 text, and keys longer than the block size are hashed first. The result labels change to HMAC to show that a key was applied.
Updated