Hash Generator
Free hash generator for MD5, SHA-1, SHA-256, SHA-512, SHA-3, BLAKE3 and CRC-32 of text or files, with HMAC and a compare field. Runs in your browser.
Updated
Any size. Read in pieces.
Hex, Base64, or a sha256sum or BSD-style line.
Options
A text box stores every line break as a line feed (LF), as the HTML standard requires. Pick CRLF to hash Windows line endings.
Type or paste text, or switch to File, to see its hashes.
What Is a Hash Generator?
The hash generator computes MD5, SHA-1, SHA-2, SHA-3, BLAKE2, BLAKE3 and CRC-32 digests of text or a file, all at once. The tool hashes text as UTF-8, or as raw bytes given in hex or Base64, and shows how many bytes it hashed. A background worker reads files of any size in pieces, so memory use stays flat and you can cancel the work. An HMAC mode takes a key, and a compare field checks a published checksum against every output.
How to Use the Hash Generator
- Type or paste text, or switch to File and pick a file.
- Under Options, pick the algorithms and the output format. Text can also be read as hex or Base64 bytes.
- Paste an expected hash to compare, or turn on HMAC under Options and enter a key for a keyed hash.
- Copy any digest. For a file, the result also has a sha256sum line and commands to check the file again on your own computer.
How It Works
MD5 produces a 128-bit digest (RFC 1321). FIPS 180-4 specifies SHA-1, SHA-224, SHA-256, SHA-384 and SHA-512, with digests from 160 to 512 bits, and FIPS 202 specifies SHA3-224, SHA3-256, SHA3-384 and SHA3-512. BLAKE2b produces up to 64 bytes and BLAKE2s up to 32 (RFC 7693), and the default BLAKE3 output is 256 bits. CRC-32 is a 32-bit checksum whose check value for the input 123456789 is cbf43926.
Text becomes bytes through UTF-8, as the browser's TextEncoder does, with no trimming and no Unicode normalization. A text box stores every line break as a line feed (LF), so text pasted from a Windows file loses its carriage returns unless you pick CRLF. GNU echo writes a newline after the last string it prints, so echo output piped into sha256sum hashes that newline too.
A background worker reads files in pieces and feeds each piece to every selected algorithm in one pass, so memory use does not grow with the file. The browser's built-in digest function cannot do this. It supports only SHA-1, SHA-256, SHA-384 and SHA-512 and needs the whole input in memory (MDN). The tool uses the hash-wasm library instead.
HMAC combines a secret key with an iterated hash function (RFC 2104). The key can have any length, but RFC 2104 strongly discourages keys shorter than the hash output, and RFC 6151 says new protocol designs should not use HMAC-MD5.
MD5 is no longer acceptable where collision resistance is required (RFC 6151), and NIST says SHA-1 should be phased out by December 31, 2030. None of these digests is a password hash. OWASP says fast hashing algorithms such as SHA-256 are not suitable for password storage.
Algorithms
| Algorithm | Output | Standard | HMAC |
|---|---|---|---|
| MD5 | 128 bits (32 hex characters) | RFC 1321 | Yes |
| SHA-1 | 160 bits (40 hex characters) | FIPS 180-4 | Yes |
| SHA-224 | 224 bits (56 hex characters) | FIPS 180-4 | Yes |
| SHA-256 | 256 bits (64 hex characters) | FIPS 180-4 | Yes |
| SHA-384 | 384 bits (96 hex characters) | FIPS 180-4 | Yes |
| SHA-512 | 512 bits (128 hex characters) | FIPS 180-4 | Yes |
| SHA3-224 | 224 bits (56 hex characters) | FIPS 202 | Yes |
| SHA3-256 | 256 bits (64 hex characters) | FIPS 202 | Yes |
| SHA3-384 | 384 bits (96 hex characters) | FIPS 202 | Yes |
| SHA3-512 | 512 bits (128 hex characters) | FIPS 202 | Yes |
| BLAKE2b-512 | 512 bits (128 hex characters) | RFC 7693 | No |
| BLAKE2s-256 | 256 bits (64 hex characters) | RFC 7693 | No |
| BLAKE3 | 256 bits (64 hex characters) | BLAKE3 specification | No |
| CRC-32 | 32 bits (8 hex characters) | Williams CRC guide (CRC-32 parameters) | No |
Standards
Scope
What It Checks
- +Computes MD5, SHA-1, SHA-224, SHA-256, SHA-384, SHA-512, SHA3-224, SHA3-256, SHA3-384, SHA3-512, BLAKE2b-512, BLAKE2s-256, BLAKE3 and CRC-32 in one pass.
- +Hashes text as UTF-8 without trimming or normalizing it, or raw bytes given as hex or Base64, and shows the number of bytes hashed.
- +Hashes files of any size in a background worker, piece by piece, with progress and a Cancel button.
- +Computes HMAC with MD5, SHA-1, SHA-2 and SHA-3, with the key given as text or hex.
- +Compares the outputs with an expected value in hex, in Base64, or as a sha256sum or BSD tag line, and names the algorithm that matches.
- +Points out a trailing line break, a byte order mark, and text that has more than one Unicode form.
What It Does Not Check
- -It does not upload files or look hashes up in a malware or reputation database.
- -It does not reverse a hash or find an input that produces it.
- -It does not create password hashes. Use the bcrypt generator for passwords.
- -It does not change line breaks or Unicode forms unless you pick CRLF.
Defensive Use
PowerShell's Get-FileHash uses SHA-256 by default, and Microsoft notes that some algorithms, including MD5 and SHA1, are no longer considered secure against attack. RFC 6151 says MD5 is no longer acceptable where collision resistance is required, and NIST says SHA-1 should be phased out by December 31, 2030. Checking a download against a SHA-256 or SHA-3 checksum avoids relying on either.
Frequently Asked Questions
What is a Hash Generator?→
The hash generator computes MD5, SHA-1, SHA-2, SHA-3, BLAKE2, BLAKE3 and CRC-32 digests of text or a file, all at once. The tool hashes text as UTF-8, or as raw bytes given in hex or Base64, and shows how many bytes it hashed. A background worker reads files of any size in pieces, so memory use stays flat and you can cancel the work. An HMAC mode takes a key, and a compare field checks a published checksum against every output.
What is the Hash Generator used for?→
Checking that a downloaded file matches the checksum its publisher lists, computing a test value for code that hashes or signs data, and comparing the digests that different tools produce for the same input.
Is my data sent anywhere?→
No. The Hash Generator runs in your browser. What you enter stays on this page and is not sent to ImmunitySec or anyone else.
How is the Hash Generator used defensively?→
PowerShell's Get-FileHash uses SHA-256 by default, and Microsoft notes that some algorithms, including MD5 and SHA1, are no longer considered secure against attack. RFC 6151 says MD5 is no longer acceptable where collision resistance is required, and NIST says SHA-1 should be phased out by December 31, 2030. Checking a download against a SHA-256 or SHA-3 checksum avoids relying on either.
Why is my hash different from the one echo and sha256sum give?→
GNU echo writes a newline after the last string it prints, and sha256sum hashes that newline too. The tool hashes exactly the text in the box, so add a line break at the end of the text to get the same result as echo.
Is MD5 still safe for checksums?→
RFC 6151 says MD5 is no longer acceptable where collision resistance is required, such as digital signatures, and Microsoft's Get-FileHash documentation notes that MD5 and SHA1 are no longer considered secure against attack. A SHA-256 or SHA-3 checksum avoids that weakness.
How do I check a download on Windows?→
Run Get-FileHash in PowerShell with the path of the file. It uses SHA-256 by default, so compare its output with the publisher's SHA-256 checksum or with the SHA-256 value from this tool.
Can a hash be turned back into the text?→
This tool only computes hashes. OWASP says fast hashing algorithms such as SHA-256 are not suitable for password storage because they allow large numbers of guesses quickly, so a digest of a short or common input does not keep that input secret.