Developer Tools

Hash Generator — MD5, SHA-256 & HMAC

Every common digest at once — type text or drop a file and read MD5 through SHA-512 side by side, with HMAC mode and one-paste checksum verification.

In short

Generate MD5, SHA-1, SHA-256, SHA-384 and SHA-512 hashes of text or files, compute HMACs, and verify checksums — all locally in your browser, nothing uploaded.

By NaveenKumar T · Updated 18 Sep 2026

Learn: SHA-256 vs MD5 vs HMAC: How Hashing Works and Which One to Use

MD5 · SHA-1 · SHA-256/384/512
Hashes files too (streamed MD5)
HMAC mode with secret key

Runs entirely in your browser — nothing you paste or open here is uploaded, logged, or stored.How we handle data →

Why this tool

Digests without the trust problem

Sending a file to a website to 'check its hash' defeats the purpose. Here the bytes never leave your machine — WebCrypto does the math locally.

Files stay yours

Drop an installer or backup archive and it's digested in-browser — MD5 streams in chunks so even large files hash without uploading a single byte.

Verification built in

Paste the checksum from a release page into the compare field: the matching algorithm row lights up green, a mismatch warns you before you run that download.

All algorithms at once

One input, five digests, each with its own copy button — no re-running the tool because the docs wanted SHA-256 and you generated SHA-1.

HMAC when keys matter

Toggle HMAC mode to compute keyed digests (HMAC-SHA-256 and friends) for webhook signatures and API authentication — the key stays in the page.

Learn more

What a cryptographic hash actually gives you

A hash function maps any input — a word or a 4 GB ISO — to a fixed-size fingerprint, deterministically. Change one bit of input and roughly half the output bits flip. That makes digests ideal for integrity: matching fingerprints mean (to astronomical confidence) matching bytes, which is why release pages publish SHA-256 sums alongside downloads.

The SHA-2 family (SHA-256, SHA-384, SHA-512), specified in FIPS 180-4, is the current workhorse, computed here via your browser's WebCrypto API. MD5 survives for legacy checksums and content-addressing where attacks don't apply. The rule of thumb: corruption-detection may use anything; tamper-detection needs SHA-256 or better; authentication needs an HMAC, because a bare hash can be recomputed by anyone.

Worked example

The same eleven bytes — the string hello world, UTF-8, with no trailing newline — pushed through every algorithm on this page. Check any row from a terminal: echo -n "hello world" | shasum -a 256 prints the SHA-256 value below, and the -n is not optional, because the extra newline byte changes every single hex digit. Note also that the digest length is fixed by the algorithm, never by the input: hashing a 4 GB ISO with SHA-256 still yields 64 hex characters.

Digests of the string "hello world" (UTF-8, 11 bytes, no trailing newline)
Algorithm	Digest of "hello world"	Hex length
MD5	5eb63bbbe01eeed093cb22bb8f5acdc3	32
SHA-1	2aae6c35c94fcfb415dbe95f408b9ce91ee846ed	40
SHA-256	b94d27b9934d3e08a52e52d7da7dabfac484efe37a5380ee9088f7ace2efcde9	64
SHA-512	309ecc489c12d6eb4cc40f50c902f2b4d0ed77ee511a7c7a9bcd3ca86d4cd86f989dd35bc5ff499670da34255b45b0cfd830e81f605dcf7dc5542e93ae9cd76f	128
HMAC-SHA-256, key "secret"	734cc62f32841568f45715aeb9f4d7891324e6d948e4c6c60c0621cdac48623a	64

Help

Frequently asked questions

Everything you need to know about the Hash Generator.

01How do I verify a downloaded file's checksum?

Switch to the File tab, drop the file, then paste the published checksum into the compare field. The tool computes every algorithm and highlights the one that matches — if none lights up, the file differs from what the publisher hashed and shouldn't be trusted.

02Is MD5 still safe to use?

Not for security. MD5 (and SHA-1) are broken against collision attacks — attackers can craft two different inputs with the same digest. They remain fine for non-adversarial uses like cache keys and accidental-corruption checks, which is why they're included; for anything security-relevant, use SHA-256 or stronger.

03What is an HMAC and when do I need one?

An HMAC mixes a secret key into the hash, so only key-holders can produce or verify the digest. It's the standard way APIs sign webhooks (Stripe, GitHub, Shopify all use HMAC-SHA-256): recompute the HMAC of the raw request body with your secret and compare it to the signature header. This tool computes exactly that.

04Why does the same text give a different hash than my terminal?

Almost always a trailing newline: echo adds one unless you pass -n, so you're hashing different bytes. Encoding matters too — this tool hashes UTF-8. Hash 'abc' with echo -n and it will match this page exactly.

Keep working