Hash generator
Hash text or a file with SHA-256, SHA-384, SHA-512, SHA-1 and MD5, or add a key for an HMAC. Computed by your browser; the data never leaves it.
tool 15 of 21 []
all shortcuts ?
How to use it
- Type or paste text, or choose a file. Text is converted to UTF-8 bytes first, so the same text always gives the same hash as the command line, provided you avoid a trailing newline (echo adds one; printf does not).
- Every algorithm is computed at once. SHA-256 is the usual default today. SHA-1 and MD5 are included because systems still publish them as checksums, and they are flagged because they are not safe against deliberate collisions.
- Enter a key to switch to HMAC. HMAC authenticates a message with a shared secret, which a plain hash cannot do. MD5 is not offered for HMAC here.
- Use the copy button next to a row, and the Base64 toggle for formats such as Subresource Integrity values (sha384-...).
Which hash for which job
A cryptographic hash maps any input to a fixed-size fingerprint. It should be impractical to find two inputs with the same fingerprint (collision resistance) or an input for a given fingerprint (preimage resistance). SHA-256, SHA-384 and SHA-512 from FIPS 180-4 meet those goals today and are what to use for file integrity, content addressing and signatures.
MD5 (RFC 1321) has practical collision attacks, and RFC 6151 updated its security considerations in 2011 to say it should not be used where collision resistance matters. SHA-1 was broken for collisions in practice by the SHAttered attack announced in February 2017, and NIST has announced that SHA-1 should be retired from federal use by December 31, 2030. Both remain fine for non-adversarial checksums such as spotting a corrupted download, which is why this page still computes them.
None of these is a password hash. Fast hashes are exactly wrong for passwords because an attacker can try billions of guesses a second. Use a slow, salted password hashing function such as Argon2id, scrypt or bcrypt, as the OWASP Password Storage Cheat Sheet recommends.
Algorithm reference
| Algorithm | Output bits | Hex length | Defined in | Status |
|---|---|---|---|---|
| MD5 | 128 | 32 | RFC 1321 | Broken for collisions. Checksums only, not for security. |
| SHA-1 | 160 | 40 | FIPS 180-4 | Collisions demonstrated in 2017. Legacy use only. |
| SHA-256 | 256 | 64 | FIPS 180-4 | Current general-purpose choice. |
| SHA-384 | 384 | 96 | FIPS 180-4 | Current. Used for Subresource Integrity values. |
| SHA-512 | 512 | 128 | FIPS 180-4 | Current. Often faster than SHA-256 on 64-bit CPUs. |
Bits and hex lengths follow from the definitions. Status reflects the sources below as checked on the date shown.
Examples
Select an example to load it into the tool.
- abc
abc - Empty-looking space
- Unicode
Café ☕
Frequently asked questions
Is it safe to hash secrets here?
The hashing happens in your browser through the Web Crypto API and nothing is sent anywhere, which you can verify in your browser network panel. Treat any real secret with care anyway, and never use a plain hash to store passwords.
Why does my hash differ from the command line?
Usually a trailing newline. echo "abc" | sha256sum hashes four bytes (abc and a newline). Use printf abc | sha256sum, or echo -n abc, to hash three bytes. Another cause is a different text encoding; this page hashes UTF-8.
Why is MD5 labeled not for security?
Researchers can construct two different inputs with the same MD5, so it cannot prove a file was not tampered with by someone who prepared it. It still detects accidental corruption.
What is HMAC and when do I need it?
HMAC mixes a secret key into the hash, so only someone with the key can produce or verify the tag. Webhook signatures and signed cookies commonly use HMAC-SHA-256.
Can it hash a large file?
The file is read into memory in your browser, so the limit is available memory. This page caps files at 512 MB to avoid freezing the tab.
Sources
- NIST FIPS 180-4: Secure Hash Standard checked 2026-10-21
- RFC 1321: The MD5 Message-Digest Algorithm checked 2026-10-21
- RFC 6151: Updated Security Considerations for the MD5 Message-Digest and the HMAC-MD5 Algorithms checked 2026-10-21
- SHAttered: the first SHA-1 collision (CWI and Google, 2017) checked 2026-10-21
- NIST: Transition away from SHA-1 (announcement, December 2022) checked 2026-10-21
- W3C Web Cryptography API: SubtleCrypto.digest checked 2026-10-21
- OWASP Password Storage Cheat Sheet checked 2026-10-21