Nothing uploaded
Hash generator
Get the MD5, SHA-1, SHA-256, SHA-384 and SHA-512 hashes of text or a file, with HMAC and a key when you need a signature, and check a download against the hash its website lists. Files are hashed on your device and never uploaded.
Hashed as UTF-8, exactly as typed: spaces and line breaks count.
No file chosen yet. Any size works, and the file stays on this device.
Waiting for a file
Shared with whoever checks the hash. It stays on this device.
Hashes
These are the hashes of empty text. Type or paste text, or choose a file.
- MD5
- d41d8cd98f00b204e9800998ecf8427eNot for security
- SHA-1
- da39a3ee5e6b4b0d3255bfef95601890afd80709Not for security
- SHA-256
- e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
- SHA-384
- 38b060a751ac96384cd9327eb1b1e36a21fdb71114be07434c0cc7bf63f6e1da274edebfe76f65fbd51ad2f14898b95b
- SHA-512
- cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
MD5 and SHA-1 aren’t safe for security. Two files with the same MD5 or SHA-1 hash can be made on purpose, so use them only to spot accidental changes. For signatures and integrity checks, use SHA-256 or stronger.
Paste the hash from a download page, or a line of sha256sum output.
Paste a hash to check it against these.
What you type stays on this device. Nothing is uploaded.
Did this save you time? DigiTools is free, with no ads and no sign-up. Leave a tip (opens in a new tab) to help keep it that way.
Tell others what you think: review DigiTools on Trustpilot (opens in a new tab).
How to generate a hash
- Type or paste text, or choose A file and pick one. Big files are fine.
- Read the five hashes in hexadecimal or Base64. For a signature, turn on the secret key (HMAC) and enter it.
- To check a download, paste the hash its website lists under Compare: it says which algorithm matches.
Questions
Is my file uploaded?
No. The file is read and hashed in your browser on this device, so it works for private documents, and even offline. Nothing you type or choose is sent anywhere.
Can I use MD5 or SHA-1 for passwords or security?
No. Both are broken: two different files with the same hash can be made on purpose. They’re still fine for spotting accidental changes, such as a corrupted download. For security use SHA-256 or stronger, and for passwords a slow password hash such as Argon2 or bcrypt, never a plain hash.
Why is my hash different from the command line’s?
Usually an invisible difference in the text: echo adds a line break at the end (use echo -n), Windows ends lines with CR LF, and copied text can end with a space. Text here is hashed as UTF-8, exactly as typed. Files are hashed byte for byte, so they match sha256sum, shasum and certutil.
How big a file can it hash?
MD5 reads the file in pieces, so any size works. SHA hashes come from your browser’s Web Crypto, which needs the whole file in memory at once: fine for files of several hundred megabytes on most computers. If a file is too big for your browser, you still get its MD5.
What is HMAC?
A hash mixed with a secret key, so only someone with the key can make or check it. Webhooks from services such as GitHub, Stripe and Shopify are signed this way. Turn on the key, enter it as text, hexadecimal or Base64, and compare the result with the signature you received.