Hash generator

Each algorithm gives a fixed-length fingerprint; change one letter and the whole hash changes. Computed by this page:

• To check a download: whichever the publisher lists, usually SHA-256.
• For new security work: SHA-256 or SHA-512. MD5 and SHA-1 are broken for security (collisions can be made), though still fine for spotting accidental corruption.
• CRC-32 is a quick error check for files and zips, not a security hash.
• For passwords: none of these on their own. Use a slow password hash such as Argon2, scrypt or bcrypt.

1. Type or paste text, or choose a file (up to 500 MB).
2. Copy the hash you need.
3. To check a file, paste the checksum you were given: the page says which hash it matches.

Is my file uploaded?

No. The file is read and hashed in your browser, which also means a big file hashes as fast as your device can read it.

Can a hash be reversed?

No. A hash is one-way. Short or common inputs can be guessed by trying many candidates, which is why passwords need a slow, salted hash.

What is an HMAC?

A hash mixed with a secret key, used to check that a message came from someone who knows the key (webhooks and API signatures often use HMAC-SHA256).

Why doesn’t my hash match?

Text hashes depend on every byte: a trailing line break, different line endings (Windows vs Mac) or a different encoding changes the result.