Free MD5 and SHA-256 Hash Generator
Hash text or files with MD5, SHA-1, SHA-256, SHA-384 and SHA-512 at the same time, create HMAC signatures and check a download against its published checksum.
MD5 and SHA-256 Hash Generator: Hash text or files with MD5, SHA-1, SHA-256, SHA-384 and SHA-512 at the same time, create HMAC signatures and check a download against its published checksum. It is free, needs no sign-up and runs in your browser. How to use it: 1) type text or choose a file; 2) optionally turn on HMAC and enter a secret key; 3) copy a hash, or paste an expected hash to see if it matches. A hash function turns any input into a fixed length fingerprint. The same input always gives the same hash, and changing a single character gives a completely different result.
How the hash generator works
A hash function turns any input into a fixed length fingerprint. The same input always gives the same hash, and changing a single character gives a completely different result. That makes hashes ideal for checking downloads, comparing files and signing API requests.
Algorithms
| Algorithm | Length | Use today |
|---|---|---|
| MD5 | 128 bits | Legacy checksums only |
| SHA-1 | 160 bits | Legacy, Git object IDs |
| SHA-256 | 256 bits | Recommended default |
| SHA-384 | 384 bits | TLS, subresource integrity |
| SHA-512 | 512 bits | High security margins |
SHA hashes are calculated with your browser’s built-in Web Crypto engine. MD5 is not part of Web Crypto, so the tool includes its own tested implementation. Text is hashed as UTF-8 bytes, exactly as typed.
HMAC and verification
HMAC mixes a secret key into the hash. APIs such as payment gateways and webhooks use HMAC-SHA256 to prove a message is genuine. Paste a published checksum into the compare box to verify a file; hex in any case and Base64 are accepted.
Limitations
Files are read fully into memory, so the limit is 400 MB and phones may handle less. Fast hashes are not suitable for storing passwords; use bcrypt, scrypt or Argon2 for that. Web Crypto needs a secure https page.
Hash Generator (MD5, SHA-256, HMAC) FAQs
How do I check the SHA-256 checksum of a file?
Switch the input to File, choose the downloaded file and paste the checksum published by the vendor into the compare box. The tool highlights the matching algorithm in green. If nothing matches, the file is incomplete or changed, or the vendor used a different algorithm.
Is MD5 still safe to use?
MD5 is fine for spotting accidental changes, such as a corrupted download, but it is broken for security. Attackers can create two different files with the same MD5 hash. Use SHA-256 or stronger for signatures, integrity checks against tampering and any new project.
What is the difference between a hash and HMAC?
A plain hash only depends on the message, so anyone can compute it. HMAC also uses a secret key, so only someone with the key can create a valid result. Webhooks from services such as Stripe or Shopify send an HMAC so you can confirm the request really came from them.
Why do I get a different hash than another tool?
Hashes change with every byte, so check for hidden differences: a trailing space or new line, Windows versus Unix line endings, or a different text encoding. This tool hashes exactly what is in the box as UTF-8. Also confirm both tools show hex in the same case.
Want our experts to implement these improvements?
Get professional support from Hayyat Networks. Request a free consultation.