Hash Toolkit
Generate, verify, and identify cryptographic hashes. All processing happens in your browser - your data never leaves your device.
Drop file here or click to browse
File is processed locally - never uploaded
Supported Hash Types
Select Algorithms
SHA-256 and SHA-512 are NIST-approved for cryptographic use. MD5 and SHA-1 are shown for legacy compatibility only.
How to generate a SHA-256 or MD5 hash
- Tick the algorithms you need under Select Algorithms. SHA-256 and SHA-512 are on by default; add SHA-1 or MD5 if you are matching an older checksum.
- For text, type or paste it in Text Input. With Live hashing on, the hashes update as you type.
- For a file, open File Input and drop it on the box. The file is read locally; very large files take a moment and use browser memory.
- Click a hash or its Copy button to copy it.
Reading and checking the result
Each algorithm gives a fixed-length hex string, whatever the input size. The text hello gives SHA-256 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824 (64 characters) and MD5 5d41402abc4b2a76b9719d911017c592 (32 characters). Change one character and the whole hash changes.
Verify Hash compares text against an expected hash. It picks the algorithm from the length (32 = MD5, 40 = SHA-1, 64 = SHA-256, 96 = SHA-384, 128 = SHA-512) and trims spaces and newlines at both ends of the text first. To check a download, hash the file in File Input and compare it with the value published by the vendor, ideally one taken from a signed release page.
Identify guesses the type of an unknown hash from its length and format, one per line. Formats with a prefix such as $2b$ (bcrypt) or $argon2id$ are identified with high confidence. A bare 32-character hex string could be MD5, NTLM or others, so treat that result as a list of candidates.
Frequently asked questions
How do I get the SHA-256 hash of a file?
Open the File Input tab and drop the file; the hash is computed in your browser. From a terminal: sha256sum file.iso on Linux, shasum -a 256 file.iso on macOS, or Get-FileHash file.iso in PowerShell.
Why is my hash different from the one I expected?
Almost always the input differs by one invisible byte: a trailing newline (echo adds one, use printf or echo -n), Windows line endings, or a different text encoding. This page hashes text as UTF-8 exactly as typed. Hex case does not matter: ABC1 and abc1 are the same hash.
Is MD5 still safe to use?
Not for security. MD5 and SHA-1 collisions can be produced deliberately, so do not use them for signatures or integrity against an attacker. MD5 is still fine to match a file against an old checksum list or a malware hash feed.
Can a hash be reversed or decrypted?
No. A hash is one-way. Short or common inputs can still be found by guessing: attackers hash candidate passwords and compare. That is why passwords must be stored with bcrypt or Argon2, not SHA-256. The password hash verifier checks bcrypt and Argon2 hashes.
What is the difference between a hash and an HMAC?
A hash only depends on the data, so anyone can recompute it. An HMAC mixes in a secret key, so only someone with the key can produce or check it; APIs use it to sign requests and webhooks. Use the HMAC generator for that.