Skip to content
OfflineBench

Hash generator: SHA-256, MD5, SHA-1, SHA-512

Get SHA-256, MD5, SHA-1, SHA-384 and SHA-512 hashes or HMACs of text and files, and verify checksums. Nothing is uploaded.

0 bytes uploadedProcessed on this device How it works
Algorithms

Input

Type or paste text, or open a file.

Hashes

Paste a checksum to check it.

Nothing to show yet

Type text or open a file. Its hashes appear here.

How to hash text or a file

  1. Tick the algorithms you need. SHA-256 is selected by default; all ticked hashes are shown together.
  2. Type or paste text, or select Open file. Text hashes update as you type; files show progress and can be cancelled.
  3. To check a download, paste its published checksum into Compare with expected hash. The status shows which ticked algorithm matches, or “No match”.
  4. Choose the output format to match what your system expects: hex (lowercase), the default, HEX (uppercase) or Base64.
  5. For an HMAC, turn on HMAC and enter the HMAC key. The key is used as UTF-8 text and is never stored.

Algorithms

SHA-256
64 hex characters. The standard choice for checksums, signatures and HMACs today.
SHA-384 and SHA-512
96 and 128 hex characters. Longer SHA-2 hashes; on 64-bit computers they can be faster than SHA-256.
MD5 and SHA-1
32 and 40 hex characters. Broken for security: collisions can be created on purpose. Still common as checksums for detecting corruption, so they are labeled “checksums only”.
HMAC
A keyed hash (RFC 2104) for signing API requests and webhooks. Available with SHA-1, SHA-256, SHA-384 and SHA-512; MD5 isn’t offered with HMAC.
File size
Up to 8 GB per file (2 GB on phones and tablets). Above 1 GB (500 MB on phones and tablets) hashing may be slow.

How hashing works

A hash function turns any input into a fixed-length fingerprint. Changing a single bit of the input gives a completely different hash, and the input can’t be worked out from the hash. Text is hashed as UTF-8 bytes, so abc gives the same SHA-256 here as printf abc | sha256sum or shasum -a 256 on the command line, as long as no trailing newline is added.

Files are read in 4 MB chunks in a background thread and fed to every selected hash at once, so memory use stays flat and very large files work.

Troubleshooting

  • The hash differs from the command line. Commands like echo abc | sha256sum include a newline. Use echo -n, or add the newline here.
  • “No match.” Check that you hashed the right file and that the algorithm the site published is ticked: only ticked algorithms are compared. Paste only the hash, without the file name that checksum files list after it.
  • MD5 is greyed out. HMAC is offered for the SHA family only.

How your data stays private

Everything happens in your browser, on your device. Your files and text are never uploaded, never stored, and never put in the address bar.

  • The site’s security policy (connect-src 'self') tells your browser to block any attempt by the page to send data to another server.
  • Only your preferences, such as the theme and a tool’s last-used options, are saved in your browser’s local storage. Never your content.
  • To check it yourself, open your browser’s developer tools, select the Network tab, and use the tool: no request carries your data.

There is no account, no sign-up and no watermark. After your first visit, pages open without a connection; a tool’s larger parts, such as the PDF and image engines, are saved the first time you use it, so it works offline from then on.

Frequently asked questions

How do I verify a file checksum?

Select Open file and choose the file, then paste the checksum from the download page into “Compare with expected hash”. The tool tells you which of the ticked algorithms matches, or that none does. Spaces, a prefix such as “sha256:” and, for hex checksums, letter case don’t matter. Large files are read in chunks in a background thread, so even multi-gigabyte files work without filling memory.

Can a SHA-256 or MD5 hash be decrypted?

No. A hash isn’t encryption: it’s a one-way fingerprint, and the original data can’t be calculated from it. Sites that claim to “decrypt” hashes look them up in tables of common passwords and phrases. That works for short, common inputs, which is why passwords need slow, salted algorithms such as Argon2 or bcrypt rather than a plain hash.

Is MD5 secure?

Not for security. Researchers can create two different files with the same MD5 (and SHA-1) hash, so they must not be used for passwords, signatures or certificates. They are still fine for detecting accidental changes, such as a corrupted download, and many sites publish them as checksums. Use SHA-256 or stronger for anything security-related.

What is HMAC?

HMAC combines a hash with a secret key, so only someone with the key can produce or check the value. APIs use it to sign requests and webhooks (for example HMAC-SHA256). Turn on HMAC and enter the key, and each ticked SHA algorithm shows the HMAC of your text or file; MD5 isn’t available with HMAC. The key stays in the page’s memory and is never stored.

Are my files uploaded?

No. Hashing runs in your browser, on your device; files are read in chunks and never leave it. Nothing you enter, including the HMAC key, is stored or put in the URL, and the site’s security policy blocks the page from sending data to other servers.

Related tools