Hash Generator (MD5 & SHA)
Hash text or a file as you type — 14 digests including MD5, SHA-256, SHA-3 and BLAKE3, plus HMAC, 7 input encodings and checksum verify. In your browser.
Digests update as you type.
Kept in this browser only, and never the secret key.
…or hash a file:
Drop any file here to hash it
🔒 Everything is hashed in your browser — nothing is uploaded.
Compute and verify cryptographic hashes locally
Type in the box or drop a file and 14 digests appear at once, recomputed as you type — there is no hash button. SHA-1, SHA-256, SHA-384 and SHA-512 come from your browser's built-in Web Crypto API; CRC32 and MD5 are computed in JavaScript; and SHA-224, SHA3-256, SHA3-512, Keccak-256, RIPEMD-160, BLAKE2b-256, BLAKE2b-512 and BLAKE3 come from a WebAssembly build loaded only when this tool needs it. One switch adds six more you still meet in the wild — MD4 (NTLM hashes), SM3 (GM/T 0004-2012), Whirlpool (ISO/IEC 10118-3), BLAKE2s-256, Adler-32 (RFC 1950) and xxHash64 — in their own on-demand chunk, so nobody downloads a Whirlpool to get a SHA-256.
A hash is a hash of bytes, so you choose how the box is read: UTF-8, UTF-16LE,
UTF-16BE, Latin-1, Hex, Hex, ignoring other characters, or Base64. deadbeef is
eight ASCII letters under one reading and four bytes under another, and the two digests share nothing —
which is why a UTF-8-only tool can never check a hash somebody took over a hex key or a Base64 payload.
Malformed input is refused by name (a character that is not a hex digit, an odd number of hex digits, a
character Latin-1 has no byte for) instead of being quietly repaired, because a silently dropped nibble
hands you a digest that matches nowhere.
Sign with a secret key (HMAC) turns the list into nine keyed digests (RFC 2104): HMAC-MD5, HMAC-SHA-1, HMAC-SHA-224, HMAC-SHA-256, HMAC-SHA-384, HMAC-SHA-512, HMAC-SHA3-256, HMAC-SHA3-512 and HMAC-RIPEMD-160 — the construction behind webhook signatures, AWS SigV4 and JWT HS256, which is why a plain digest never matches one. The key gets its own encoding picker and is never written to storage. CRC32, Keccak, BLAKE2b and BLAKE3 are deliberately absent: HMAC is not defined for a checksum, and BLAKE2b and BLAKE3 take a key in their own construction instead.
Verify a download by pasting the expected checksum — the matching row is highlighted
and the algorithm named. It accepts hex in either case, standard or URL-safe Base64, an SRI /
npm-integrity value such as sha256-…, a sha256sum-style line (the first token
wins), and a bare string of bits. Every digest can be shown as lower-case hex, upper-case HEX, Base64,
Base64url or binary, and the whole list saves as a .checksums.txt file. Files up to 256 MB
can be hashed; the file is held as a handle and re-read when you change an option, rather than sitting
in the tab as bytes. The text box can optionally be remembered on this device — never the secret key.
Nothing you hash is uploaded.
Frequently asked questions
Can I hash a file, and does it support MD5?
Yes to both — drop any file to get its MD5 and SHA hashes (useful for verifying downloads), and MD5 is included alongside the SHA family.
Can I verify a file against a published checksum?
Yes — paste the expected checksum into the verify box and it highlights the matching hash and names its algorithm, or tells you nothing matched. It understands hex in either case, standard or URL-safe Base64, an SRI / npm-integrity string such as sha256-…, a sha256sum-style line (the first token is used), and a plain string of 0s and 1s.
Is the text or file I hash uploaded?
No. Hashing runs entirely in your browser — nothing is uploaded.
Which algorithms does it compute?
Fourteen by default, all at once: CRC32, MD5, SHA-1, SHA-224, SHA-256, SHA-384, SHA-512, SHA3-256, SHA3-512, Keccak-256, RIPEMD-160, BLAKE2b-256, BLAKE2b-512 and BLAKE3. A switch adds six more for older or non-cryptographic work — MD4, SM3, Whirlpool, BLAKE2s-256, Adler-32 and xxHash64 — which are only downloaded if you turn them on.
Can it compute an HMAC with a secret key?
Yes. Turn on 'Sign with a secret key (HMAC)' and the list becomes nine keyed digests (RFC 2104): HMAC-MD5, HMAC-SHA-1, HMAC-SHA-224, HMAC-SHA-256, HMAC-SHA-384, HMAC-SHA-512, HMAC-SHA3-256, HMAC-SHA3-512 and HMAC-RIPEMD-160 — the same construction as a webhook signature, AWS SigV4 or JWT HS256. The key has its own encoding picker and is never stored. CRC32, Keccak, BLAKE2b and BLAKE3 are not listed, because HMAC is not defined for a checksum and BLAKE2b and BLAKE3 take a key in their own construction.
My hash does not match the one I was given — why?
Usually the two sides are hashing different bytes. Set 'Read the text as' to match how the other side read it: UTF-8, UTF-16LE, UTF-16BE, Latin-1, Hex, 'Hex, ignoring other characters' or Base64 — a hex key hashed as UTF-8 text gives a completely unrelated digest. And if the value you were given is a signature rather than a checksum, no plain digest will ever match it; turn on the secret key and compare the HMAC.
Can I get the digest in upper case, Base64 or binary?
Yes — the output format picker switches every row at once between lower-case hex, upper-case HEX, Base64, Base64url and binary. The same list also downloads as a .checksums.txt file in whichever format is showing.
How big a file can it hash, and do I have to press anything?
Up to 256 MB, and no — digests update as you type or as soon as a file is dropped, with a short pause so a burst of typing is one run rather than one per keystroke. A file over the limit is refused with both sizes named instead of freezing the tab, and the file itself is kept as a handle, so changing an option re-reads it rather than holding a copy in memory.