Hash Generator (SHA-256, MD5, SHA-512)

Runs locally

MD5, SHA-1, SHA-256, SHA-384 and SHA-512 of text or files, plus HMAC and checksum checks.

Computed with your browser’s Web Crypto API. Text, files and HMAC secrets never leave this tab.

Text

43 bytes (UTF-8)

Digests

Guide

A hash identifies content; it does not hide it or protect it

A cryptographic hash turns input of any size into a fixed-size digest: 256 bits for SHA-256, 128 for MD5. The same input always gives the same digest, and a one-bit change gives a completely different one, which is why digests are used as checksums, cache keys and content addresses. A hash has no key and cannot be reversed, but it can be guessed: short or common inputs are found by trying candidates.

MD5 and SHA-1 are broken for security — attackers can create two different files with the same digest — so use them only to spot accidental corruption. SHA-256 is the default for anything that matters. When the digest also has to prove who produced it, use an HMAC: the same hash mixed with a secret key, which is what webhook signatures and HS256 JWTs are.

The most common "wrong hash" is not a bug at all: the input differs by a trailing newline, a byte-order mark or a different text encoding. Hashes are over bytes, and this page hashes exactly the UTF-8 bytes shown. If you need a random secret for an HMAC, generate one with the password generator.

Text

abc

Digests

MD5      900150983cd24fb0d6963f7d28e17f72
SHA-1    a9993e364706816aba3e25717850c26c9cd0d89d
SHA-256  ba7816bf8f01cfea414140de5dae2223
         b00361a396177a9cb410ff61f20015ad

echo "abc" | sha256sum   → edeaaff3…  (hashes "abc\n")
echo -n "abc" | sha256sum → ba7816bf…

These are the published test vectors for "abc". The echo lines show why a terminal and a web page disagree: echo adds a newline unless you pass -n.

Where people get caught

The trailing newline

Files and echo output usually end with \n, and it changes the digest. The tool warns when your text ends with a line break.

Hashing passwords with SHA-256

A fast hash lets an attacker try billions of guesses per second. Passwords need a slow, salted algorithm — Argon2id, scrypt or bcrypt — not a plain digest.

Comparing hex case or Base64 with hex

A1B2 and a1b2 are the same digest; Base64 and hex are the same bytes in different spellings. The checksum field accepts all of them and compares bytes.

MD5 for integrity against an attacker

MD5 still catches a truncated download, but anyone can craft a malicious file with a chosen MD5. Verify against SHA-256 when the source might be hostile.

About hashing

How it works in 4 steps · 4 common use cases · 4 questions answered

How it works

  1. 1.Type text, or drop or upload a file; all five digests appear together.
  2. 2.Choose lower-case hex, upper-case hex or Base64 output.
  3. 3.Paste an expected checksum to see ✓ match or ✗ mismatch, and which algorithm matched.
  4. 4.Switch to HMAC, enter a secret, and get HMAC-SHA256, -SHA384 and -SHA512.

Common use cases

  • •Verifying a downloaded ISO or release archive against its published SHA-256
  • •Checking a webhook signature (HMAC-SHA256) while debugging
  • •Producing a stable cache key or ETag for a piece of content
  • •Comparing two files without uploading either

FAQ

Can a SHA-256 hash be decoded?

No. A hash is one-way. Sites that "decrypt" hashes look them up in tables of precomputed digests of common inputs, which only works for short or popular strings.

MD5 or SHA-256?

SHA-256 for anything that matters. MD5 is fine for catching accidental corruption but can be forged deliberately, and many security tools reject it.

Why is my hash different from sha256sum?

Almost always a trailing newline (echo adds one), a different text encoding, or Windows line endings. Hash the exact same bytes and the digests match.

Should I hash passwords with SHA-256?

No. Use Argon2id, scrypt or bcrypt, which are deliberately slow and salted. A plain SHA-256 of a password can be brute-forced quickly.

Related tools