Hash Generator & Checksum Verifier (MD5, SHA-256, HMAC)
Last updated:
Hash text or a file with MD5, SHA-1, SHA-256, SHA-384 and SHA-512 (or HMAC), and verify a checksum. When a hash doesn't match, it tells you why, like the trailing newline that echo adds. All in your browser, nothing uploaded.
How it works
A hash is of bytes, not of the text you see. The most common “my hash doesn’t match” isn’t a bug in either tool. echo "secret" | sha256sum hashes secret plus a newline, because echo appends one. A web form, printf, or echo -n hashes just secret. The two SHA-256 values have nothing in common:
| Command | SHA-256 starts with |
|---|---|
printf secret | sha256sum |
2bb80d53… |
echo secret | sha256sum |
b37e50ce… |
Windows line endings (CRLF vs LF), a UTF-8 byte order mark at the start of a file, and a stray trailing space do the same thing invisibly. So when you paste an expected hash and it doesn’t match, this tool doesn’t stop at “no match”. It retries those byte-level variants and tells you which one would have matched, for example “it would match SHA-256 with a trailing newline added”. Try the example to see it.
- The algorithm is detected from the expected hash’s length (32 hex digits = MD5, 40 = SHA-1, 64 = SHA-256, 96 = SHA-384, 128 = SHA-512). You can paste a bare hash, a line of
sha256sumoutput with the file name after it, or a Subresource Integrity value likesha256-…in base64. - Files are hashed as raw bytes, so the result matches
sha256sum file,shasum -a 256, or PowerShellGet-FileHash. The file is read in your browser and never uploaded. That makes this a safe way to check a download against the checksum on a release page. - Text is hashed as UTF-8. Tools that hash text as UTF-16 (like .NET’s
Encoding.Unicode) give a different answer for the same characters. Switch the input to hex or base64 to hash exact bytes. - HMAC (RFC 2104) mixes in a secret key. It’s how webhook signatures (Stripe, GitHub) and HS256 JWTs are made. The key here is used as UTF-8 text.
MD5 and SHA-1 are marked “not for security”. Collisions for both can be produced on purpose, so they’re fine for catching accidental corruption but not for anything an attacker controls. Don’t use any of these for storing passwords either: a fast hash is the wrong tool there, and bcrypt, scrypt, or Argon2 exist for that.
Runs entirely in your browser: SHA hashes use the built-in Web Crypto API, and MD5 is computed in JavaScript since Web Crypto doesn’t include it. Nothing you paste or drop here is uploaded, logged, or stored.