About this tool
This hash generator computes the five digests developers reach for most, MD5, SHA-1, SHA-256, SHA-384, and SHA-512, from any text you type or any file you choose, and shows each one as lowercase or uppercase hex and as Base64 with a copy button. Switch on HMAC mode by entering a key (as UTF-8 text, hex, or Base64) to produce keyed message authentication codes for API signatures and webhook verification. Paste an expected checksum into the compare field and the page tells you which algorithm, if any, it matches, which is the quickest way to verify a download against a published SHA-256 or MD5 sum. Because everything runs locally, it is safe to use on secrets, tokens, and private files. It is for developers checking integrity, writing tests that need known hash values, debugging signature mismatches, and anyone verifying a file against its checksum.
How it works
MD5 (RFC 1321) and SHA-256 (FIPS 180-4) are implemented in plain JavaScript on the page: the input is encoded as UTF-8 bytes, padded with a single 1 bit, zeros, and the 64-bit message length to a multiple of 512 bits, and each 64-byte block is run through the algorithm's 64 rounds of additions, rotations, and bitwise functions (MD5 uses little-endian words and sine-derived constants; SHA-256 uses big-endian words and constants from the cube roots of the first 64 primes). SHA-1, SHA-384, and SHA-512 use the browser's built-in WebCrypto digest, and keyed hashes follow RFC 2104: HMAC(K, m) = H((K' XOR opad) || H((K' XOR ipad) || m)), where K' is the key padded or hashed to the block size (64 bytes for MD5, SHA-1, and SHA-256; 128 bytes for SHA-384 and SHA-512). Hex output writes each byte as two hexadecimal digits; Base64 output encodes the same raw digest bytes. The page's built-in checks confirm the RFC test vectors, for example MD5 of an empty string is d41d8cd98f00b204e9800998ecf8427e and SHA-256 of abc is ba7816bf 8f01cfea 414140de 5dae2223 b00361a3 96177a9c b410ff61 f20015ad.
Frequently asked questions
Why does my hash not match the one from md5sum or sha256sum?
The usual cause is a trailing newline. Running echo "hello" | sha256sum hashes hello plus a line feed, because echo appends one; use printf or echo -n to avoid it, or tick the append-newline option here to reproduce it. Other causes are Windows CRLF line endings versus LF, a UTF-8 byte order mark at the start of a file, and different Unicode normalization of accented characters. Hash the exact bytes and the results will agree.
Is MD5 or SHA-1 still safe to use?
Not for anything security-related. Practical collision attacks exist for both: two different inputs with the same MD5 can be produced in seconds, and the SHAttered attack produced a SHA-1 collision in 2017. They are still fine for non-adversarial uses such as detecting accidental corruption, deduplicating files, or cache keys. For digital signatures, certificates, password storage, and integrity checks against an attacker, use SHA-256 or SHA-512, and for passwords specifically use a slow, salted algorithm such as bcrypt, scrypt, or Argon2.
What is the difference between a hash and an HMAC?
A plain hash depends only on the message, so anyone can recompute it; it proves integrity but not origin. An HMAC mixes a secret key into the computation, so only parties who know the key can produce or verify the code. That makes HMAC-SHA256 the standard way to sign webhooks (Stripe, GitHub, Slack), API requests (AWS Signature v4), and JWTs with the HS256 algorithm. If you hold the key, HMAC also guarantees the message was not altered in transit.
How is Base64 output related to the hex output?
They encode the same digest bytes. A SHA-256 digest is 32 bytes: in hex that is 64 characters, in Base64 it is 44 characters ending in one = padding character. Some systems, such as Subresource Integrity attributes (sha256-...), Docker image digests, and JWT signatures, expect Base64 or Base64url, while checksum files and most command-line tools use hex. Convert between them freely; the underlying value is identical.