How to use Hash Generator
- Type or paste text, or switch to File and choose or drop a file (up to 256 MB).
- Read the hashes on the right; each row has its own Copy, and Copy all takes the set.
- To check a download, paste the published checksum into Compare: the matching row turns green, or the page says no match.
- Tick HMAC with a key and type the secret to sign the text the way APIs and webhooks do.
Why use Hash Generator
Every algorithm at once
No choosing first: all five hashes appear as you type, with SHA-256 highlighted.
Files, on the device
Read by your browser and hashed there, MD5 in 4 MB pieces, so a 200 MB installer can be checked without uploading it.
Checksum check
Paste the hash from the download page: case does not matter, and the page guesses which algorithm it is.
HMAC
Keyed hashes (HMAC-SHA256 and the others) for signing requests and verifying webhooks.
About this tool
A hash is a fixed-length fingerprint of data: change one byte and the whole hash changes, which is how download pages let you check that a file arrived intact and unmodified, and how APIs sign requests with a shared key (HMAC). SHA-256 is the standard today; MD5 and SHA-1 still appear on older download pages and in legacy systems, which is why they are shown too, though neither is safe against a deliberate forgery any more.
The SHA family comes from the browser's Web Crypto; MD5, which browsers no longer ship, is implemented here and streams files in pieces. Everything is computed on your device: the page makes no requests while you work, so hashing a private document or a secret is fine.
Frequently asked questions
How do I verify a downloaded file's SHA-256?
Switch to File, choose the download, paste the checksum from the site into Compare. A green "Matches SHA-256" means the file is exactly the one the publisher hashed.
Which hash should I use?
SHA-256 for anything new. MD5 and SHA-1 only to match an existing checksum; they are fast but forgeable.
Can it hash a password?
It can, but a plain hash is the wrong tool for storing passwords: use bcrypt, scrypt or Argon2 on the server. Do not paste real passwords into any web page.
What is HMAC for?
A hash mixed with a secret key, so only someone with the key can produce it. Webhooks (Stripe, GitHub) and signed API requests use HMAC-SHA256.
Are line endings included?
Yes. Text is hashed exactly as typed, as UTF-8, including a trailing line break if there is one, which is why a hash of a file can differ from a hash of its pasted text.
Does it make SHA-1 hashes?
Yes. It works as an MD5, SHA1 (SHA-1), SHA-256, SHA-384 and SHA-512 hash generator, for text or files.