A hash function turns any input into a short, fixed-length fingerprint called a digest. The same input always gives the same digest, a tiny change gives a completely different one, and you cannot work backwards from the digest to the input. It is used to check that data has not changed.

Is hashing the same as encryption?

No. Encryption is reversible with a key; hashing is one way and has no key. Nothing can be “decrypted” from a SHA-256 hash. Someone can only guess inputs and hash them to see whether they match, which is why short or common inputs, such as simple passwords, can still be found.

Are MD5 and SHA-1 safe to use?

Not for security. Collisions (two different inputs with one hash) can be created deliberately for both, so they must not be used for signatures, certificates or anything an attacker could tamper with. They are still fine for checksums that only guard against accidental corruption, and many download pages still publish them. For anything security-related use SHA-256 or stronger.

Can I store passwords as SHA-256 or MD5 hashes?

No. General-purpose hashes are built to be fast, so an attacker can test billions of guesses per second against a stolen list. Passwords need a deliberately slow, salted password hash such as bcrypt, scrypt or Argon2, used through a well-tested library.

What is CRC32, and is it a secure hash?

CRC32 is a 32-bit checksum used in ZIP, PNG, gzip and Ethernet to detect accidental changes. It is not a cryptographic hash: it is easy to craft different data with the same CRC32, so use it only for error detection.

HMAC mixes a secret key into a hash, giving a code that proves the message was made by someone who knows the key and was not altered. It is used to sign API requests and webhooks. This tool computes HMAC-SHA-256, HMAC-SHA-384, HMAC-SHA-512 and HMAC-SHA-1, with the key and message taken as UTF-8 text. An empty key is not accepted.

How do I check a downloaded file’s checksum?

Choose the file, paste the checksum from the download page into “Compare with an expected hash” and read the result. The length tells which algorithm it is: 64 hex characters is SHA-256, 40 is SHA-1, 32 is MD5. A match means the file is identical to the one that was hashed; it only proves it is authentic if the checksum itself came from a source you trust.

Why does my hash differ from another tool’s?

Usually the input differs. A trailing newline, different line endings, a space, or a different text encoding changes the hash completely. This tool hashes text as UTF-8 and reports the byte count, so you can compare it with the other tool’s. A browser text box also normalises line breaks to a single line feed; hash a file if you need exact bytes.

Is my text, key or file sent anywhere or saved?

No. Hashing runs in your browser with its built-in Web Crypto and code on this page. Nothing you enter is uploaded, and nothing is saved: reload and it is gone. The only thing the site records, if you allow analytics, is that a button was used, never any of your text, keys or files.

Why is there a 50.0 MB file limit?

The browser’s built-in SHA functions hash a whole file at once, so the file has to fit in memory. Larger files are refused before they are read; for those, use the sha256sum, shasum or certutil command on your computer.

Hash Generator

Type or paste text, or choose a file, to get its SHA-256, SHA-384, SHA-512, SHA-1, MD5 and CRC32 hashes at once, as lowercase or uppercase hex or Base64. The example “The quick brown fox jumps over the lazy dog” has the SHA-256 d7a8fbb307d7809469ca9abcb0082e4f8d5651e46d3cdb762d02d0bf37c9e592 and the MD5 9e107d9d372bb6826bd81d3542a419d6. Paste a checksum into “Compare with an expected hash” to see whether it matches, and which algorithm its length points to. Switch to HMAC to sign the input with a secret key. MD5 and SHA-1 are broken for collision resistance: fine for spotting accidental corruption, not for security. A hash is not encryption, and a plain hash is not a safe way to store passwords. Everything is computed in your browser; your text, key and files are never uploaded or saved.

Updated 2026-10-03Runs in your browser: nothing you enter is uploadedHow this tool works

Input

TextFile

Function

HashHMAC (secret key)

Text to hashStays in your browser

Hashed on this device as UTF-8 and never uploaded or saved: reload the page and it is gone.

Hashes

Output

Hashed 43 characters (43 UTF-8 bytes).

SHA-256256 bits · 64 hex charactersOK: no practical attacks known
d7a8fbb307d7809469ca9abcb0082e4f8d5651e46d3cdb762d02d0bf37c9e592
SHA-384384 bits · 96 hex charactersOK: no practical attacks known
ca737f1014a48f4c0b6dd43cb177b0afd9e5169367544c494011e3317dbf9a509cb1e5dc1e85a941bbee3d7f2afbc9b1
SHA-512512 bits · 128 hex charactersOK: no practical attacks known
07e547d9586f6a73f73fbac0435ed76951218fb7d0c8d788a309d785436bbb642e93a252a954f23912547d1e8a3b5ed6e1bfd7097821233fa0538f3db854fee6
SHA-1160 bits · 40 hex charactersBroken for collision resistance
2fd4e1c67a2d28fced849ee1bb76e7391b93eb12
MD5128 bits · 32 hex charactersBroken for collision resistance
9e107d9d372bb6826bd81d3542a419d6
CRC3232 bits · 8 hex charactersNot a cryptographic hash
414fa339

Compare with an expected hash

Paste a checksum in hex. Case, spaces and line breaks are ignored, and its length tells which algorithm it is.

Paste a checksum to compare it with the digests above.

Hash algorithms compared

Output sizes and status of each algorithm this tool computes. “Broken” refers to collision resistance: attackers can build two different inputs with the same hash.
Algorithm	Output (bits)	Hex characters	Base64 characters	Status	Use it for
SHA-256	256	64	44	OK: no practical attacks known	File checksums, signatures, certificates, blockchains
SHA-384	384	96	64	OK: no practical attacks known	Where a longer SHA-2 digest is required, such as some TLS suites
SHA-512	512	128	88	OK: no practical attacks known	Same uses as SHA-256; often faster on 64-bit CPUs
SHA-1	160	40	28	Broken for collision resistance	Checksums and legacy systems such as Git object names, not security
MD5	128	32	24	Broken for collision resistance	Quick integrity checks and legacy checksums, not security
CRC32	32	8	8	Not a cryptographic hash	Detecting accidental corruption in ZIP, PNG and Ethernet

Hashes of the empty string

The digest of zero bytes, as hex. Handy for spotting an empty file or an empty field that was hashed by mistake.
Algorithm	Hash of the empty string
SHA-256	e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA-384	38b060a751ac96384cd9327eb1b1e36a21fdb71114be07434c0cc7bf63f6e1da274edebfe76f65fbd51ad2f14898b95b
SHA-512	cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
SHA-1	da39a3ee5e6b4b0d3255bfef95601890afd80709
MD5	d41d8cd98f00b204e9800998ecf8427e
CRC32	00000000

How to generate a hash of text or a file

Choose text or a file. Pick “Text” and type or paste it, or pick “File” and choose a file up to 50.0 MB. The file is read on your device only.
Read the hashes. Every algorithm is computed at once and updates as you type. Choose lowercase hex, uppercase hex or Base64, and copy the one you need.
Compare with an expected hash. Paste the checksum the download page or the other party gave you. Spaces, line breaks and letter case are ignored; the length identifies the algorithm, and the tool says match or no match.
Use HMAC if you need a keyed hash. Switch to HMAC, enter a secret key, and the SHA hashes become HMAC values for the same text or file.

Frequently asked questions

What is a hash?: A hash function turns any input into a short, fixed-length fingerprint called a digest. The same input always gives the same digest, a tiny change gives a completely different one, and you cannot work backwards from the digest to the input. It is used to check that data has not changed.
Is hashing the same as encryption?: No. Encryption is reversible with a key; hashing is one way and has no key. Nothing can be “decrypted” from a SHA-256 hash. Someone can only guess inputs and hash them to see whether they match, which is why short or common inputs, such as simple passwords, can still be found.
Are MD5 and SHA-1 safe to use?: Not for security. Collisions (two different inputs with one hash) can be created deliberately for both, so they must not be used for signatures, certificates or anything an attacker could tamper with. They are still fine for checksums that only guard against accidental corruption, and many download pages still publish them. For anything security-related use SHA-256 or stronger.
Can I store passwords as SHA-256 or MD5 hashes?: No. General-purpose hashes are built to be fast, so an attacker can test billions of guesses per second against a stolen list. Passwords need a deliberately slow, salted password hash such as bcrypt, scrypt or Argon2, used through a well-tested library.
What is CRC32, and is it a secure hash?: CRC32 is a 32-bit checksum used in ZIP, PNG, gzip and Ethernet to detect accidental changes. It is not a cryptographic hash: it is easy to craft different data with the same CRC32, so use it only for error detection.
What is HMAC?: HMAC mixes a secret key into a hash, giving a code that proves the message was made by someone who knows the key and was not altered. It is used to sign API requests and webhooks. This tool computes HMAC-SHA-256, HMAC-SHA-384, HMAC-SHA-512 and HMAC-SHA-1, with the key and message taken as UTF-8 text. An empty key is not accepted.
How do I check a downloaded file’s checksum?: Choose the file, paste the checksum from the download page into “Compare with an expected hash” and read the result. The length tells which algorithm it is: 64 hex characters is SHA-256, 40 is SHA-1, 32 is MD5. A match means the file is identical to the one that was hashed; it only proves it is authentic if the checksum itself came from a source you trust.
Why does my hash differ from another tool’s?: Usually the input differs. A trailing newline, different line endings, a space, or a different text encoding changes the hash completely. This tool hashes text as UTF-8 and reports the byte count, so you can compare it with the other tool’s. A browser text box also normalises line breaks to a single line feed; hash a file if you need exact bytes.
Is my text, key or file sent anywhere or saved?: No. Hashing runs in your browser with its built-in Web Crypto and code on this page. Nothing you enter is uploaded, and nothing is saved: reload and it is gone. The only thing the site records, if you allow analytics, is that a button was used, never any of your text, keys or files.
Why is there a 50.0 MB file limit?: The browser’s built-in SHA functions hash a whole file at once, so the file has to fit in memory. Larger files are refused before they are read; for those, use the sha256sum, shasum or certutil command on your computer.

How it works

Text is converted to UTF-8 bytes and a file is read as raw bytes. SHA-1, SHA-256, SHA-384 and SHA-512 are computed by the browser’s Web Crypto (crypto.subtle.digest). MD5 (RFC 1321) and CRC32 (the IEEE 802.3 polynomial used by ZIP, PNG and gzip) are not in Web Crypto, so they are implemented in this page’s own code and tested against the RFC 1321 test suite and the standard check value. HMAC (RFC 2104) uses Web Crypto with the key and message as UTF-8 bytes, and is tested against the RFC 4231 test vectors. Hex output uses two characters per byte, in lowercase or uppercase; Base64 is the standard alphabet with padding. CRC32 is written as four bytes, most significant first, the way checksums are listed. The example on this page is computed when the site is built with Node’s own crypto module, and a test confirms the browser produces identical output. When you compare a checksum, whitespace is removed and letters are lowercased, then the hex is compared with the digest the length points to.

Sources

All tools Home & DIY calculators