What is a hash function?
A cryptographic hash function turns any input — a word, a JSON payload, a 2 GB ISO image — into a fixed-length fingerprint. The same input always produces the same hash, changing a single bit produces a completely different one, and it is infeasible to work backwards from the hash to the input. That makes hashes ideal for verifying downloads, detecting changed files, cache keys and ETags, deduplication and digital signatures.
This tool computes MD5, SHA-1, SHA-256, SHA-384 and SHA-512 at once. The SHA family uses your browser’s native Web Crypto API (crypto.subtle.digest), and MD5 — which Web Crypto deliberately omits — is implemented in JavaScript and verified against the RFC 1321 test vectors. Text is hashed as UTF-8 bytes; files are read locally and never uploaded.
HMAC mode combines a hash with a secret key (RFC 2104). It is how services such as Stripe, GitHub and WooCommerce sign webhooks: the receiver recomputes the HMAC of the request body with the shared secret and compares it with the signature header.
How to use the Hash Generator
- Type or paste text, or switch to File and choose a file from your device.
- All five hashes are calculated instantly. Choose lowercase hex, uppercase hex or Base64 output.
- For a keyed hash, tick HMAC and enter the secret key as text or hex bytes.
- To verify a download or signature, paste the expected value into Compare with expected hash — the matching algorithm is highlighted.
Example
Hashes of the text abc (no trailing newline):
MD5 900150983cd24fb0d6963f7d28e17f72
SHA-1 a9993e364706816aba3e25717850c26c9cd0d89d
SHA-256 ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015adNever use MD5, SHA-1 or plain SHA-256 for passwords
MD5 and SHA-1 are cryptographically broken: practical collision attacks exist, so they must not be used for signatures or certificates. They remain acceptable only as non-security checksums. And although SHA-256 is secure as a hash, no fast hash is suitable for storing passwords — a single GPU can test billions of SHA-256 guesses per second.
Store passwords with a deliberately slow, salted algorithm: Argon2id, bcrypt or scrypt. In PHP use password_hash() and password_verify(). WordPress has used bcrypt for user passwords since version 6.8; earlier versions used the phpass portable hash (salted, iterated MD5). Generate strong passwords with the Password Generator.
Why does my hash not match?
- A trailing newline:
echo "abc" | sha256sumhashesabc\n. Useecho -norprintf. - Windows line endings (
\r\n) versus Unix (\n) in copied text. - Different text encodings — this tool always uses UTF-8.
- Hex versus Base64 output, or a hash of the hex string instead of the raw bytes.
Frequently Asked Questions
Can a hash be decrypted or reversed?
No. Hashing is one-way, not encryption. “MD5 decrypt” sites simply look up precomputed hashes of common inputs, which is exactly why unsalted fast hashes are dangerous for passwords. For reversible encoding, use the Base64 Encoder.
Which hash algorithm should I use?
SHA-256 is the default choice for checksums, integrity checks and HMAC signatures. Use SHA-512 if a specification asks for it. Use MD5 or SHA-1 only to match legacy systems, never for security.
Are my text and files uploaded?
No. Hashing happens entirely in your browser. You can verify this by disconnecting from the internet — the tool keeps working.
How do I verify a downloaded file’s checksum?
Choose File, select the download, and paste the checksum published by the vendor into the comparison field. A green match confirms the file is intact and unmodified. On the command line, use sha256sum file (Linux), shasum -a 256 file (macOS) or Get-FileHash file (PowerShell).
Why are SHA hashes unavailable on some pages?
Browsers only expose crypto.subtle in secure contexts (HTTPS or localhost). If you open a copy of this page over plain HTTP, only MD5 — implemented in JavaScript — can be calculated.