More
More
Hash Generator & File Checksum
SHA and MD5 hashes of text or files, HMAC signatures, and checking a download against its published checksum.
Free tools that run in your browser. Nothing you type, open or create is uploaded to NerdBible or anyone else.
Text is encoded as UTF-8 before hashing, which is what nearly every tool and language does. Text hashes and HMAC signatures come from your browser's Web Crypto engine, with MD5 computed by a small script because browsers no longer offer it. Files are hashed in 4 MB pieces by a background worker on this page, so even very large downloads can be checked without uploading them.
How to use it
- For text, type or paste it: every hash updates as you type. Choose hex or Base64, and upper case if the place you compare against uses it.
- To check a download, open File checksum, drop the file, and paste the checksum published on the download page. The box says plainly whether it matches.
- To sign a message, open HMAC, enter the message and the secret key, and copy the signature, or paste one to compare.
Questions
Which hash should I use?
SHA-256 for checksums and general use. SHA-384 and SHA-512 where a standard asks for them. MD5 and SHA-1 only to match an old system, since both can be forced to collide and are not safe for security.
Can I hash passwords with this?
Not for storing them. Plain SHA and MD5 are far too fast, so stolen hashes can be guessed by the billion. Password storage needs a slow, salted method such as bcrypt, scrypt or Argon2.
Why does my hash differ from another tool?
Usually a hidden difference in the input: a trailing line break or space, Windows line endings, or a different text encoding. Hashes change completely when one byte changes.
Why check a download's checksum?
A matching SHA-256 proves the file is exactly the one the publisher released: not damaged in transfer and not swapped for a tampered copy on a mirror. Check it against the checksum on the official site, ideally over https, since a mirror that altered the file could alter its checksum too.
What is an HMAC?
A hash that mixes in a secret key. Payment providers, GitHub and many other services sign webhooks with HMAC-SHA256 so the receiver can prove a message came from them and was not changed. Anyone without the key cannot produce a matching signature.
Is a hash reversible?
No. A hash is a one way fingerprint. Short or common inputs can still be found by guessing, which is why a hash of a password or a phone number is not anonymous.
About this tool
About the hash generator
A hash is a short fingerprint of some data. Change one byte and the fingerprint changes completely, which makes hashes the standard way to check that a file arrived intact or that two pieces of text are identical.
Three tools in one
- Text: type or paste and see MD5, SHA-1, SHA-256, SHA-384 and SHA-512 update as you type, in hex or Base64.
- File checksum: drop a download and paste the checksum from the publisher's site. The page says plainly whether they match. Large files are hashed in 4 MB pieces by a background worker, so even big disk images work.
- HMAC: sign a message with a secret key, or check a signature, as used for webhooks from payment providers and code hosts.
Which hash to use
SHA-256 is the right choice for checksums and most general use. MD5 and SHA-1 are only for matching older systems, since both can be made to collide. None of these is suitable for storing passwords: they are far too fast to guess against, which is what bcrypt and similar slow methods are for.
When hashes do not match
Look for an invisible difference in the input: a trailing space or line break, Windows line endings, or a different text encoding.
Text and files are hashed on your device and never uploaded.
Related tools
- Bcrypt Generator & VerifierHash a password with bcrypt or check one against a hash.
- Base64 Encode & DecodeEncode and decode Base64 text.
- RSA Key Pair GeneratorPublic and private keys, generated in your browser.
- Encrypt & Decrypt Text or FilesLock text or a file with a password using AES encryption, and unlock it again.
- JWT Decoder & EncoderRead a JSON Web Token, check an HS256 signature or sign a test token.