About the Hash Generator
Introduction
A cryptographic hash function turns any input – a word, a password, a 4 GB ISO image – into a short, fixed-length fingerprint called a hash, digest or checksum. The same input always gives the same hash, the smallest change gives a completely different one, and the original data cannot be recovered from it. This tool computes 17 hashes at once – MD5, SHA-1, the SHA-2 and SHA-3 families, BLAKE2, BLAKE3, RIPEMD-160, CRC32 and xxHash – for text or for a file of any size.
How to use it
Text: type or paste into the text box; every hash updates as you type. Switch UTF-8 text to Hex bytes or Base64 bytes to hash raw binary data instead of characters.
File: drop a file anywhere on the page, click the drop area, or paste a file with Ctrl + V. Files are read in chunks, so even multi-gigabyte downloads work and a progress bar shows the speed.
Verify: paste the checksum published on a download page into Verify. The matching algorithm lights up; if nothing matches, the tool tells you which algorithms produce a hash of that length.
HMAC: tick HMAC with secret key to sign the input with a key – the scheme used for webhook signatures (GitHub, Stripe, Slack) and many API authentications.
Choose hex, HEX or Base64 output and copy any value with one click.
Short links: develzone.org/hash, /md5, /sha256, /checksum and /hmac. Pasting a hash into the search box on the home page opens it here, ready to verify.
Which algorithm should I use?
SHA-256 – the safe default: file checksums, digital signatures, TLS certificates, Bitcoin, Docker image digests.
SHA-512 / SHA-384 – SHA-2 with longer output; often faster than SHA-256 on 64-bit processors.
SHA-3 (SHA3-256, SHA3-512) – the newest NIST standard, built on a completely different design (Keccak) as a backup to SHA-2. Ethereum uses the original Keccak-256, which differs from SHA3-256 in one padding byte, so the two give different results.
BLAKE2 and BLAKE3 – modern, secure and very fast. BLAKE2 is used by Argon2, WireGuard and many package managers; BLAKE3 is one of the fastest secure hashes available.
MD5 and SHA-1 – broken: researchers can create two different files with the same hash. Still fine for spotting accidental corruption or matching old checksums, but never for passwords, signatures or security.
CRC32, CRC32C, xxHash – not cryptographic at all. They detect random errors in ZIP files, network packets and storage extremely fast, but anyone can craft a collision on purpose.
Do not hash passwords like this
Fast hashes are the wrong tool for storing passwords: a graphics card can try billions of SHA-256 or MD5 guesses per second. Use a deliberately slow password hashing function such as Argon2id, bcrypt or scrypt with a unique salt per user.
Privacy
All hashing runs in your browser using WebAssembly. Text, files and HMAC keys are never uploaded or stored, so it is safe to check confidential documents and secrets. Once the page has loaded it even works offline.
Good to know
Hashes are computed over bytes, not characters. "café" hashes differently in UTF-8 and in an older encoding, and Windows line endings (\r\n) give a different hash than Unix ones (\n). A trailing newline counts too – echo "text" | sha256sum hashes "text" plus a line break.
The command-line equivalents are md5sum, sha256sum and b3sum on Linux, shasum -a 256 on macOS and Get-FileHash -Algorithm SHA256 in PowerShell.
Hashing is not encryption: there is no key to "decrypt" a hash. For reversible encodings use the URL / HTML / Base64 encoder.