A hash generator for MD5, SHA-2 and SHA-3
The Hash Generator computes the most widely used cryptographic hashes of any text or file in one go: MD5, SHA-1, SHA-256, SHA-384, SHA-512, SHA3-256, SHA3-384, SHA3-512 and Keccak-256. Type or paste text and every hash updates as you type, or drop in a file of any size your browser can hold.
Developers use it to check downloads against published checksums, compare files without opening them, debug API request signatures, create HMACs with a secret key, and look up the Keccak-256 values used by Ethereum. Paste an expected hash into the compare box and the matching algorithm lights up — no need to know in advance which one was used.
All hashing happens on your device. Text, files and secret keys are never uploaded, so it is safe to hash confidential documents or test real API secrets.
How to use the Hash Generator
- Choose Text or File.
- Type or paste your text, or drop a file onto the drop area. Large files show a progress bar and can be cancelled.
- Pick an Output format: lowercase hex (the usual checksum format), uppercase hex or Base64.
- To sign a message, tick Use a secret key (HMAC) and enter the key as text, hex or Base64.
- To verify a checksum, paste it into Compare with expected hash. A green badge names the matching algorithm.
- Copy any single hash with its copy button, or press Copy all.
Hash Generator features
Nine algorithms at once
MD5, SHA-1, the SHA-2 family, the SHA-3 family (FIPS 202) and Keccak-256 are shown side by side.
Correct SHA-3 and Keccak
SHA-3 uses the final FIPS 202 padding, and Keccak-256 uses the original padding that Ethereum adopted — two different results that many tools confuse.
HMAC for every algorithm
Create HMAC-SHA256, HMAC-SHA512, HMAC-MD5 or HMAC-SHA3 signatures with a key entered as text, hex or Base64 (RFC 2104).
Checksum comparison
Paste an expected hash in hex or Base64; the matching algorithm is highlighted automatically.
Fast file hashing
SHA hashes use the browser’s native Web Crypto engine; MD5 and SHA-3 run in chunks with a progress bar so the page stays responsive.
Verified implementation
Every algorithm is checked against the published test vectors for the message “abc” and the RFC 2104 and RFC 4231 HMAC examples.
Which hash algorithm should you use?
A cryptographic hash turns any input into a fixed-length fingerprint. Changing a single bit of the input changes about half of the output bits, and it is infeasible to work backwards from the hash to the input.
| Algorithm | Output | Status | Typical use |
|---|---|---|---|
| MD5 | 128-bit (32 hex) | Broken — collisions are easy | Non-security checksums, cache keys, legacy systems |
| SHA-1 | 160-bit (40 hex) | Deprecated — practical collisions since 2017 | Git object IDs, legacy signatures |
| SHA-256 | 256-bit (64 hex) | Secure | File checksums, TLS, Bitcoin, JWT HS256, most new systems |
| SHA-384 / SHA-512 | 384 / 512-bit | Secure | High-assurance signatures; SHA-512 is fast on 64-bit CPUs |
| SHA3-256 / SHA3-512 | 256 / 512-bit | Secure | Designs needing an alternative to SHA-2 |
| Keccak-256 | 256-bit | Secure | Ethereum addresses, function selectors, smart contracts |
Why your hash might not match
- Line endings and trailing newlines. Files saved on Windows use CRLF, and many editors add a final newline. Text typed here uses LF with no trailing newline, so hashing the file and its pasted contents can differ — hash the file itself to compare checksums.
- Character encoding. Text is hashed as UTF-8. The same words saved as UTF-16 or Latin-1 produce different bytes and a different hash.
- Wrong format. A Base64 hash and a hex hash of the same bytes look nothing alike; the compare box accepts both.
- HMAC key encoding. A key given as hex, such as
0b0b0b…, must be entered with “Hex bytes”, not as text.
Hashes are not for storing passwords
Fast hashes like SHA-256 are the wrong tool for password storage, because attackers can try billions of guesses per second on a GPU. Use a slow, salted password hash such as bcrypt, scrypt or Argon2 — the Bcrypt Generator creates and checks bcrypt hashes, and the File Hash Checker is tailored to verifying downloads.
Hash Generator FAQ
How do I generate a SHA-256 hash?
Type or paste your text into the box, or switch to File and drop a file. The SHA-256 hash appears instantly in the list together with the other algorithms; press its copy button to copy it. This hash generator works offline once the page has loaded.
Can a hash be reversed or decrypted?
No. Hash functions are one-way. Sites that claim to “decrypt” MD5 simply look up hashes of common words in huge precomputed tables, which is why short or common inputs are guessable and why passwords need salted, slow hashes.
What is the difference between SHA-3 and Keccak-256?
Both use the Keccak permutation, but NIST changed the padding when it standardised SHA-3 in FIPS 202. Ethereum adopted Keccak before that change, so its “SHA3” is really Keccak-256. The two give completely different outputs for the same input.
What is an HMAC?
An HMAC (hash-based message authentication code) mixes a secret key into the hash, so only someone with the key can produce or verify it. APIs such as AWS, Stripe and GitHub webhooks use HMAC-SHA256 to sign requests.
Is it safe to hash confidential files here?
Yes. The file is read by your browser and hashed in memory on your device. Nothing is uploaded, logged or stored.
How large a file can I hash?
Files up to about 2 GB can be hashed if your device has enough memory. SHA-1 and SHA-2 use the browser’s native engine and are very fast. MD5 and the SHA-3 family run in JavaScript, so a 100 MB file takes around 20 seconds on a typical laptop (longer on phones), with a progress bar and a Cancel button.