Hash Generator
Compute MD5, SHA-1, SHA-256, SHA-384, and SHA-512 hashes of text or a file, plus HMAC — all at once, entirely in your browser.
Prefer the terminal? See the CLI equivalent →About the Hash Generator
- MD5 & the SHA family
- HMAC
- File checksums
- Instant results
- 100% private — runs in your browser
- Free, no sign-up
Compute cryptographic hashes of text or a file: MD5, SHA-1, SHA-256, SHA-384, and SHA-512 are all calculated at once, so you can copy whichever your task needs. A separate HMAC section computes a keyed hash for message authentication.
A hash is a fixed-length fingerprint of its input — the same input always produces the same digest, and any change produces a completely different one. That makes hashes useful for verifying file integrity (compare a download’s checksum), fingerprinting content, and — with a secret key (HMAC) — authenticating messages.
Everything runs in your browser. Text is hashed as UTF-8 bytes and files are read locally; nothing is uploaded, so you can safely checksum private files. SHA and HMAC use the built-in Web Crypto API; MD5 (which Web Crypto no longer provides) uses a small, well-known library.
How to use it
- Choose “Text” and type/paste, or “File” and drop a file.
- Read the MD5 / SHA digests — all computed live — and copy any of them.
- To compute an HMAC, enter a secret key and pick a SHA algorithm.
Which algorithm?
- SHA-256
- The modern default for integrity and fingerprints.
- SHA-512 / SHA-384
- Longer digests; SHA-512 is often faster on 64-bit CPUs.
- SHA-1
- Legacy; broken for collision resistance — avoid for security.
- MD5
- Legacy checksums only; cryptographically broken — never for security.
- HMAC
- A keyed hash proving a message came from someone holding the key.
Frequently asked questions
Is my text or file uploaded?+
No. Hashing runs entirely in your browser with client-side JavaScript (Web Crypto for SHA/HMAC, a local library for MD5). Your input never leaves your device, so it’s safe to checksum private files.
Should I still use MD5 or SHA-1?+
Only for non-security purposes like matching a legacy checksum or de-duplicating files. Both are broken for collision resistance — use SHA-256 or stronger for anything security-related.
Why can’t I choose MD5 for HMAC?+
HMAC here uses the browser’s Web Crypto API, which supports the SHA family only. HMAC-MD5 is also legacy and best avoided.
How is text hashed — which encoding?+
Text is encoded as UTF-8 before hashing, so accented and non-Latin characters hash consistently with other UTF-8 tools. Files are hashed byte-for-byte.
Works well with
Hash Generator chains with these tools — send your result straight on:
Related tools
ASN.1 Decoder
Decode ASN.1 DER/BER — paste PEM, Base64, or hex and see the tag–length–value tree behind X.509 certificates, keys, and CMS, entirely in your browser.
Certificate Decoder
Decode X.509 / PEM certificates — view subject, issuer, validity, SANs, key, and fingerprints, all in your browser.
JWT Debugger
Decode and inspect JSON Web Tokens: view the header and payload, check expiry, and verify HS/RS/PS/ES signatures — all in your browser.
JWT Signer
Build a JWT header and payload and sign it with HMAC (HS256/384/512) or an RSA/ECDSA private key (RS/PS/ES) — entirely in your browser. Nothing is uploaded.
Metadata Inspector
Inspect the hidden metadata in a photo or document — EXIF, GPS location, author, dates, and more — right in your browser. Download a cleaned copy with the metadata removed.
Metadata Stripper
Strip EXIF, GPS, author, and hidden metadata from images and documents in one batch — locally in your browser. JPEG, PNG, WebP, GIF, PDF, Office, OpenDocument & EPUB.