Hash & HMAC generator.
Generate SHA-256, SHA-512, MD5 and other hashes of text or a file, all at once. Add a key for HMAC. Paste an expected checksum and it tells you which algorithm matches. Nothing leaves your browser.
Digests
About this tool
SHA-1, SHA-256, SHA-384, SHA-512 and every HMAC come from the browser's built-in WebCrypto API, which is the same native implementation the browser uses for TLS. MD5 and CRC32 are not in WebCrypto, so they are small JavaScript implementations here. Text is hashed as UTF-8 bytes; files are hashed byte for byte and never leave your machine.
The algorithms
| Algorithm | Output | Use it for |
|---|---|---|
| SHA-256 | 256 bits, 64 hex characters | The default choice. File checksums, content addressing, signatures, HMAC for webhooks, certificate fingerprints. |
| SHA-512 | 512 bits, 128 hex | When you want a longer digest or are on 64-bit hardware where it is often faster than SHA-256. |
| SHA-384 | 384 bits, 96 hex | Truncated SHA-512; used in some TLS suites and Subresource Integrity. |
| SHA-1 | 160 bits, 40 hex | Legacy only. Git object IDs and old checksums. Collisions are practical; do not use it for anything security-related. |
| MD5 | 128 bits, 32 hex | Legacy only. Still everywhere in download checksums, ETags and cache keys. Broken for security; fine for detecting accidental corruption. |
| CRC32 | 32 bits, 8 hex | Not a cryptographic hash at all. Error detection in ZIP, PNG and Ethernet. |
| HMAC-SHA256 and friends | Same length as the underlying hash | A hash keyed with a secret. Proves the message came from someone who knows the key. Webhook signatures, API request signing, session tokens. |
SHA-256 checksum of a file
Drop the file onto the page. It is read in your browser and every digest is computed locally, so a multi-gigabyte ISO is fine. Paste the published checksum into the Expected field: the verifier accepts hex or Base64 in either case, tells you which algorithm produced it and whether it matches. The same result from a terminal is shasum -a 256 file on macOS or sha256sum file on Linux.
HMAC generator for webhook signatures
Stripe, GitHub, Slack, Shopify and most other providers sign webhooks with HMAC-SHA256. Enter the shared secret as the key and the raw request body as the text to reproduce what the sender computed, then paste the signature from the header into the Expected field to confirm it matches. The mismatch is almost always the body: a framework has parsed and re-serialised the JSON, changing whitespace or key order, so you are signing different bytes from the ones the sender signed. Some providers also prepend a timestamp and a dot to the body before signing (Stripe and Slack do; GitHub does not). The details per provider are in how to verify webhook signatures. Capture the raw body exactly as sent with the webhook tester.
Hash vs encryption vs encoding
A hash is one-way: you cannot get the input back from the digest, and the same input always gives the same digest. Encryption is two-way with a key. Encoding (such as Base64) is two-way with no key and hides nothing. Hashing a password with plain SHA-256 is not enough; use a slow, salted algorithm such as bcrypt, scrypt or Argon2.
Uses
- Verifying a downloaded ISO, installer or package against the published SHA-256 or MD5.
- Debugging a webhook signature mismatch by reproducing the HMAC by hand.
- Generating a fingerprint for a config file or a fixture to detect changes.
- Checking whether two files are identical without opening them.
- Producing a Subresource Integrity hash (
sha384-plus the Base64 output).
From the command line
echo -n 'text' | shasum -a 256 (macOS) or sha256sum (Linux); md5 file or md5sum file; HMAC with echo -n 'body' | openssl dgst -sha256 -hmac 'secret'. The -n matters: a trailing newline changes the hash.