Log In Sign Up Free

🔐 Hash Generator

Generate MD5, SHA-1, SHA-256, SHA-384, SHA-512, and CRC32 hashes for text or files. HMAC mode with a secret key. Verify downloads. Runs entirely in your browser.

Input text0 chars
Leave empty to skip. If any row above matches your input, it'll be highlighted green.
📁

Drop a file here or click to browse

Any file type — text, images, PDFs, executables, archives

Max 20 MB · runs entirely in your browser · no upload
📄
—
—
Perfect for checking that a downloaded file matches the source's advertised hash — the matching algorithm row turns green.
Copied to clipboard

About Hash Generator

Hash Generator is a free browser-based tool for computing cryptographic and checksum hashes of text or files. Paste some text or drop a file, and get MD5, SHA-1, SHA-256, SHA-384, SHA-512, and CRC32 hashes computed instantly — all client-side.

A hash is a fixed-length "fingerprint" derived from any input. The same input always produces the same hash; even a tiny change flips most of the output bits. Hashes are used everywhere: verifying downloads, storing passwords, indexing content in Git, signing messages, deduping files.

Our tool uses the browser's native crypto.subtle.digest for the SHA family (a certified WebCrypto implementation) plus pure-JS implementations of MD5 and CRC32. HMAC mode lets you compute keyed hashes with SHA-1/256/384/512 — the standard for API signing and cookie signing.

100% client-side: Hashing runs in your browser. No text, no file, no key ever touches our servers. Safe for API keys, passwords, or downloaded firmware.

How to use Hash Generator

1

Pick a mode

Text for hashing a string. File for hashing an entire file up to 20 MB.

2

Input your content

Paste text or drop a file. Optionally enable HMAC mode + type a secret key for keyed hashes.

3

Copy or verify

Copy any hash to your clipboard, or paste an expected hash into the verify box to see if the file/text matches.

Key Features

Six algorithms in one tool

MD5 (16 bytes) — legacy checksum. SHA-1 (20 bytes) — Git-style content addressing. SHA-256 (32 bytes) — the modern standard. SHA-384 / SHA-512 (48/64 bytes) — for high-security needs. CRC32 (4 bytes) — the fast integrity checksum in ZIP/PNG/Ethernet.

Live text hashing

Every keystroke recomputes every hash. See fingerprints change in real time — great for teaching the avalanche effect or spot-checking small edits.

File hashing up to 20 MB

Drag and drop any file — text, image, PDF, executable, archive. We compute all six hashes with a progress bar. Perfect for verifying downloads against a published checksum.

Built-in verify mode

Paste an expected hash — the tool tells you which algorithm produced it and whether your input matches. No need to guess whether that string is MD5 or SHA-256.

HMAC mode

Toggle HMAC + type a secret key to compute keyed hashes (HMAC-SHA1/256/384/512). Standard for signing API requests, JWTs, and cookies.

Uppercase toggle

Many systems (Windows CertUtil, SQL Server) output hex in UPPERCASE. Toggle to match their format when comparing.

Copy each hash or all at once

Per-row Copy button + "Copy all" for a labeled multi-line report. Download as .txt for saving alongside a file as a checksum manifest.

Common Use Cases

  • Verify a downloaded ISO / installer / firmware against the vendor's published hash
  • Compute a Git-compatible SHA-1 for content addressing
  • Generate a checksum manifest (multiple algorithms) for a release artifact
  • Sign an API request or JWT with HMAC-SHA256
  • Store password hashes for a personal project or exercise (real apps should use bcrypt/argon2 — but MD5/SHA are educational)
  • Dedupe files by comparing their hashes instead of byte-for-byte comparison
  • Check that two "identical looking" files really are identical (spot invisible whitespace, encoding, or line-ending differences)
  • Learn how the avalanche effect works — change one character and watch the hash mutate

Security & Privacy

  • 100% client-side: hashing runs in your browser via Web Crypto (SHA family) + inline pure-JS (MD5, CRC32). Nothing uploaded.
  • Works offline: once the page loads, disconnect and it still works.
  • No logging of content: your text, files, or HMAC keys are never seen or stored by us.
  • Web Crypto for SHA: browser-certified implementation — same one used by TLS, WebAuthn, and signed cookies.
  • File never uploaded: we use FileReader.readAsArrayBuffer — the file bytes stay in your browser's memory.
  • MD5 and SHA-1 are broken for security: use SHA-256 or higher for anything involving trust or authentication. MD5/SHA-1 remain fine as checksums.

Frequently Asked Questions

SHA-256 for anything involving trust (downloads, signatures, JWT). MD5 or CRC32 only as quick integrity checksums where security doesn't matter. SHA-1 is still fine for Git-style content addressing but not for security.
No. We use FileReader.readAsArrayBuffer — the file bytes stay in your browser. Nothing hits our servers. Verify by disconnecting from the internet after loading the page — hashing still works.
20 MB — a browser-side limit to keep the page responsive. For hashing larger files, use a native tool like sha256sum, certutil -hashfile, or PowerShell's Get-FileHash.
Sort of — paste an expected hash into the Verify field. If the current input's MD5/SHA/CRC output matches, that row turns green. So if you paste an unknown 64-hex-char hash and it matches, it was SHA-256.
No — for real password storage use bcrypt, argon2, or scrypt. Plain MD5/SHA are too fast to brute-force. This tool is for checksums, signing, and dedup — not password hashing.
Yes. Completely free, no signup, no ads.