Hash Generator

Type or paste text in the box above and eight hashes appear at once, updating as you type: MD5, SHA-1, SHA-256, SHA-384, SHA-512, SHA3-256, SHA3-512 and CRC32. Switch Hash of to File to fingerprint any file instead. Every line has its own copy button, so you take exactly the value you need.

This hash generator also does the jobs that usually need a second tool: HMAC with a secret key, a salt added before or after the input, output as lowercase hex, uppercase HEX or Base64, a Check a hash box that tells you whether a value matches, and bcrypt for making and checking password hashes.

All of it runs in your browser. Text, keys, salts, passwords and files never leave the page, and nothing is uploaded, not even a large download you want to check.

A hash function turns any input, from one letter to a whole disk image, into a short fixed-length value called a hash, digest or checksum. The same input always gives the same hash. Change a single bit and the hash changes completely, with no visible pattern linking the two.

That makes a hash a fingerprint. You can compare two hashes instead of comparing two large files byte by byte, store a hash to notice later changes, or publish one so others can confirm they received exactly what you sent. A good cryptographic hash also makes it impractical to find two different inputs with the same hash, called a collision, or to work back from a hash to an input.

A hash is not encryption. There is no key that turns it back into the original, and the output has the same length whether you hashed one word or a whole film.

Most people arrive needing one thing: the SHA-256 of some text or a file, right now. A sha256 hash generator online should not make you press a button, wait for a server or create an account, and this one does not. The SHA-256 line fills in as you type, and the copy icon puts the 64 hex characters on your clipboard.

Because the work happens on your device, there is no upload limit and no queue. For text the result is instant. For a file, a small note shows Reading… with a percentage while the file is read in slices.

If you only care about SHA-256, simply ignore the other lines. They cost almost nothing to compute for text, and they are there when a download page lists SHA-512 or MD5 instead.

MD5 produces a 128-bit hash, written as 32 hex characters, and it is still everywhere: older download pages, database columns, cache keys, duplicate-file finders and many APIs. The first row of the list is the hash generator md5 result for your text or file. It is computed by a small built-in implementation, because the browser's own crypto does not offer MD5.

The honest part: MD5 is broken for security. Researchers have been able to create different files with the same MD5 for many years, and such collisions have been used in real attacks on certificates. Do not use MD5 to sign anything, to store passwords or to prove that a file from an untrusted source is safe.

It is still fine for what it is mostly used for today: noticing accidental damage. If a download was cut short or a copy got corrupted, the MD5 will not match. When you have the choice, though, compare SHA-256 instead.

SHA-256 belongs to the SHA-2 family published by NIST. It produces a 256-bit hash, 64 hex characters, and no practical collision has ever been found. It is the hash most software download pages, package managers, code-signing systems and TLS certificates rely on.

This hash generator sha256 row is computed by your browser's built-in Web Crypto (crypto.subtle), the same code the browser uses for secure connections, so the result is fast and standard. If a value from this page and one from a command line differ, the inputs differ; the troubleshooting section below lists the usual causes.

Use SHA-256 as your default for checksums, file fingerprints, HMAC signatures and anything new. Choose something longer only when a system asks for it.

SHA-512 is the larger member of SHA-2: a 512-bit hash, 128 hex characters or 88 in Base64. On 64-bit computers it is often as fast as SHA-256 or faster, because it works on 64-bit words. A hash generator sha512 value is common on Linux download pages and in some package formats and signature schemes.

SHA-384 is a shortened SHA-512 with different starting values, 96 hex characters long. It is used in some TLS settings and in Subresource Integrity attributes on web pages, which are written as sha384- followed by the Base64 hash. Choose Base64 under Output to get a value in that form.

Is SHA-512 safer than SHA-256? Both are far beyond any known attack. The longer output gives a larger margin, which some standards ask for, but for checking a download either is more than enough. Use the one the publisher lists.

SHA3-256 and SHA3-512 come from SHA-3, a newer standard (FIPS 202) built on a completely different design called Keccak. SHA-3 is not a replacement for SHA-2, which is still secure, but a backup with different internals. Browsers do not include SHA-3, so this page computes it with its own code. Note that SHA3-256 is not the same as the older Keccak-256 used by some blockchains: the padding differs, so the hashes differ.

CRC32 is not a cryptographic hash at all. It is a 32-bit error-detecting code, 8 hex characters, used inside ZIP files, PNG images and many storage formats. It catches accidental corruption well, but anyone can craft a file with a chosen CRC32. Use it to match a CRC shown by an archive tool, not for security. CRC32 is left out in HMAC mode, because HMAC needs a real hash function.

A hash is just bytes; hex and Base64 are two ways to write those bytes as text. hex writes each byte as two characters from 0–9 and a–f, so an MD5 is 32 characters. HEX is the same value in capital letters, as some Windows tools and older documents show it. The value is identical, only the letter case differs, and Check a hash ignores case for hex.

Base64 packs the same bytes into fewer characters, using A–Z, a–z, 0–9, + and /, with = as padding at the end. A SHA-256 is 44 characters in Base64 instead of 64 in hex. You need Base64 for Subresource Integrity, for many API signature headers and for some config files. Base64 is case-sensitive, so copy it exactly.

Text input matters as much as output. The page turns your text into bytes with UTF-8, the encoding used by almost every website, API and modern system, so accented letters, Chinese characters and emoji give the same hash here as in any UTF-8 program. A line break in the text box counts as one newline character, and spaces at the end are kept. If you want the hash of a word without a trailing newline, make sure the cursor sits right after the last letter.

Older Windows programs sometimes save text in UTF-16 or a local code page instead. The same visible word then has different bytes and therefore a different hash. When a hash from a desktop program does not match, saving the text as a file and hashing that file in both places is the fairest test.

The most useful everyday job for a hash is checking a download. The publisher lists the SHA-256 (or MD5, SHA-1 or SHA-512) of the file. After downloading, you compute the hash yourself. If the two values are identical, your copy is exactly the file they published: not cut short, not corrupted and not swapped on the way.

To use this page as a hash generator for file checks, switch Hash of to File, select or drop the download, and paste the published value into Check a hash. A green row and the message Matches the SHA-256 hash tell you the file is identical. No match means stop: download it again, ideally from the official site, and check again.

One caution: a hash proves the file matches the published value, not that the publisher can be trusted. If an attacker controls the download page, they can change both the file and the hash. For important software, get the hash from a second place, such as signed release notes, or check the signature.

You can also check without a browser. Every major operating system has a built-in command:

Large files are where browser tools usually struggle. Here, MD5, SHA3-256, SHA3-512 and CRC32 read the file in 8 MB slices, one after another, so even a file of several gigabytes is processed without loading it into memory all at once. You see Reading… and a percentage while that happens. That makes this an md5 hash generator for file sizes far beyond what an upload form would accept.

SHA-1, SHA-256, SHA-384 and SHA-512 use the browser's own crypto, which needs the whole file in memory at once. For everyday files that is no problem. For very large files, a browser with little free memory may fail, and the line then shows a dash (—). If that happens, close other tabs and try again, or use one of the commands in the table above.

In HMAC (with key) and With salt modes, the whole file is read into memory for every algorithm, so the same note applies. The file itself is never uploaded: it is read locally, and the name and size shown stay on your screen.

Paste any expected value into Check a hash and the page compares it with every hash in the list. If one matches, that row turns green and the message names the algorithm, for example Matches the MD5 hash. You do not need to know which algorithm the publisher used; the match tells you.

The comparison ignores spaces at the start and end, ignores letter case for hex and accepts a leading 0x. It compares against the format chosen under Output, so for a hex value keep Output on hex or HEX, and for a Base64 value switch to Base64. The message No match with any hash above means the input differs, or the value belongs to another file.

HMAC, short for hash-based message authentication code, mixes a secret key into the hash in a fixed, well-studied way (RFC 2104). Anyone can compute the SHA-256 of a message, but only someone who knows the key can compute its HMAC-SHA256. That is how webhooks, payment callbacks and many APIs prove that a message really came from the sender and was not changed on the way.

To use this as a hash generator with key, choose HMAC (with key) under Type and type the key in Secret key. The list then shows HMAC-MD5, HMAC-SHA-1, HMAC-SHA-256, HMAC-SHA-384, HMAC-SHA-512, HMAC-SHA3-256 and HMAC-SHA3-512 for your text or file. The SHA-1 and SHA-2 versions use the browser's crypto; HMAC-MD5 and HMAC-SHA3 are computed with the standard HMAC formula. CRC32 is not shown, as it has no HMAC.

HMAC needs a secret key to mean anything. With an empty key box you still get a result, but anyone can reproduce it, so it proves nothing. The key is used exactly as typed, as UTF-8 text. If your service gives you a key in hex or Base64 and expects the decoded bytes, the results here will differ.

To debug a webhook, paste the exact raw body the service sent, enter the shared secret, pick hex or Base64 to match the signature header, and paste the header value into Check a hash. Remove any prefix such as sha256= first.

A salt is extra text added to the input before hashing, so the same input gives a different hash in different places. Choose With salt under Type, type the salt and choose whether the salt goes before or after. The hash is then computed of salt plus text, or text plus salt, exactly as written, with nothing in between.

This hash generator with salt is useful for reproducing what an existing system does, testing your own code or creating test values. If a system stores the SHA-256 of password plus salt, you can type both here and confirm your code gives the same result. For files, the salt is joined to the start or the end of the file contents.

What it is not: a safe way to store passwords. A salt stops attackers from using one precomputed table against many accounts, but SHA-256 and the others are designed to be fast, and a modern graphics card can try billions of salted guesses per second. For passwords, use bcrypt below or Argon2, with a high cost.

bcrypt is built for passwords. It is deliberately slow, has a cost setting you can raise as computers get faster, and adds a random salt to every hash by itself. The bcrypt (passwords) card in the tool works as a bcrypt hash generator online: type a password, set Cost from 4 to 15 and press Make bcrypt hash. Copy the result into a seed file, a test database or a config that expects a bcrypt hash.

To check a password, type it in the Password box, paste a stored hash into the box below it and press Check. You get The password matches this bcrypt hash, or The password does not match. Because each hash has its own salt, the same password gives a different hash every time you press Make bcrypt hash, and Check still works for all of them.

A bcrypt hash is 60 characters long and carries everything needed to check it: $2b$ or $2a$ for the version, the cost such as 10, then 22 characters of salt and 31 of hash. Each step up in cost doubles the work, so cost 12 takes four times as long as cost 10. A common choice is 10 to 12; pick the highest your server can handle at login without making people wait. One limit to know: bcrypt only uses the first 72 bytes of a password.

The bcrypt library (bcryptjs) loads only when you first use the card, and it runs in this page. High costs such as 14 or 15 can take several seconds in a browser; the button shows Working… in the meantime.

No. A hash is not encrypted text and has no key, so there is nothing to decrypt. Information is thrown away on purpose: a 2 GB file and a single word both end up as 64 hex characters of SHA-256.

Sites that claim to decrypt MD5 or SHA-1 are really looking the hash up in huge lists of hashes of common passwords and words. If the original was short or common, it may be in the list; if it was long and random, it will not be. That is exactly why fast hashes are unsafe for passwords, and why a long random password from the Password Generator matters.

Everything on this page is computed in your browser. Text, files, secret keys, salts and passwords are not uploaded, not logged and not put in the address bar. SHA-1 and SHA-2 use the browser's Web Crypto; MD5, SHA-3, CRC32 and the HMAC formula for them run in this page's own code, and bcrypt uses the bcryptjs library served from this site.

This hash generator remembers only your choices, such as Hash of, Output, Type, the salt position and the bcrypt cost, in this browser's local storage. The text you type, the key, the salt and the bcrypt password are never saved. You can clear the stored choices in your browser's site data settings.

Need a strong secret for an HMAC key, or a password to try with bcrypt? The Password Generator makes long random ones in your browser, and the UUID Generator gives you random IDs. To compare two outputs or config files line by line, use the Diff Checker. The JSON Formatter makes an API payload readable, but hash the original raw body, not the formatted one, because the bytes change.

Sharing a file whose hash you publish? Protect PDF adds a password to a PDF, and Remove Metadata strips hidden details from photos and documents before you send them. Both change the file, so compute and publish the hash after those steps.