Hash Generator: MD5, SHA-256, SHA-512 and HMAC

What is a hash?

A cryptographic hash function turns input of any length into a fixed-length fingerprint: 128 bits for MD5, 160 for SHA-1, 256 for SHA-256, 384 for SHA-384 and 512 for SHA-512, shown here as hexadecimal. The same input always produces the same hash, changing a single character produces a completely different one, and there is no way to run the function backwards to recover the input.

That makes hashes useful for verifying downloads, detecting changed files, deduplicating content, building cache keys and ETags, and signing data. This page computes all five digests at once, so you can match whichever one a project publishes without picking the algorithm first. Text is encoded as UTF-8 before hashing, which is what sha256sum and most programming languages do too; a different encoding (UTF-16, or a trailing newline from echo) gives a different hash.

Hashing vs encryption

Encryption is two-way: anyone with the key can decrypt the ciphertext back to the original. Hashing is one-way: there is no key and nothing to decrypt. You compare hashes by computing the hash of a candidate input and checking it matches.

HMAC sits between the two. It mixes a secret key into the hash (HMAC-SHA256 is the common choice), so only someone who knows the key can produce or verify the result. Webhook signatures from Stripe, GitHub and Slack, AWS request signing and JWTs signed with HS256 all use HMAC. Tick "HMAC with a secret key" above to compute HMAC-MD5 through HMAC-SHA512 for the same input.

MD5 and SHA-1 are broken for security, fine for checksums

Researchers can deliberately create two different inputs with the same MD5 hash in seconds, and a practical SHA-1 collision was published in 2017 (SHAttered). That rules both out for digital signatures, certificates and anything where an attacker could swap in a crafted file. Use SHA-256 or stronger there.

For non-adversarial jobs they are still fine: detecting accidental corruption, matching a legacy system's checksum column, cache keys or ETags. MD5 is also why this tool ships its own implementation: the browser's Web Crypto API refuses to offer it, so MD5 here is computed by a small built-in routine while the SHA family uses the browser's native SubtleCrypto.

Never use these hashes to store passwords

MD5 and the SHA family are designed to be fast. A single modern GPU computes billions of SHA-256 hashes per second, so a leaked table of unsalted SHA-256 password hashes can be cracked almost as quickly as plaintext. Passwords need a deliberately slow, salted algorithm such as bcrypt, scrypt or Argon2id. Use the bcrypt generator at /tools/bcrypt-generator to create and verify bcrypt password hashes with an adjustable cost factor.

Command-line equivalents

Linux: sha256sum file.zip, sha512sum file.zip, sha1sum file.zip and md5sum file.zip. To hash a string without the trailing newline that echo adds: printf '%s' 'hello world' | sha256sum.

macOS: shasum -a 256 file.zip (or -a 1, -a 384, -a 512) and md5 file.zip. HMAC: printf '%s' 'message' | openssl dgst -sha256 -hmac 'secret'.

Windows: certutil -hashfile file.zip SHA256 (also MD5, SHA1, SHA384, SHA512), or in PowerShell Get-FileHash file.zip -Algorithm SHA256. Note that certutil and Get-FileHash print uppercase hex; use the Uppercase toggle above to compare directly.