Hash Generator
MD5, SHA-1, SHA-256, SHA-512 & CRC32 with HMAC and checksum verification
Digest lengths and collision reality
A hash digests any input to a fixed-length fingerprint — one-way by design:
- MD5 (128-bit) and SHA-1 (160-bit) are broken for collisions in real attacks (SHAttered, 2017) — fine for checksums of trusted data, wrong for anything adversarial.
- SHA-256/512 remain unbroken; their length alone does not make a password safe.
- The avalanche property means flipping one bit changes roughly half the output bits — try it above.
Hashing is not encryption
Five digests at once
MD5, SHA-1, SHA-256, SHA-512, and CRC32 compute together from the same text or file, covering fingerprints, integrity checks, and checksums in a single run.
Local file hashing
Files up to 100MB are read and digested entirely on this page, making verification of a downloaded release against published checksums a purely local operation.
HMAC and verify mode
HMAC hashing with a secret key covers authenticated digests, and verify mode auto-detects which algorithm matches a pasted expected hash and highlights that row.
Frequently asked questions
Are my files uploaded to a server?
No. Text and files are hashed entirely in your browser using the Web Crypto API (SHA family) and self-contained MD5/CRC32 code. Nothing is transmitted, so it works offline and is safe for confidential data.
What is HMAC and when do I need it?
HMAC is a keyed hash used to verify both the integrity and authenticity of a message with a shared secret. Enable HMAC and enter a key to compute HMAC-MD5/SHA-1/SHA-256/SHA-512 — commonly needed for API signatures and webhooks.
Is MD5 or SHA-1 still safe to use?
For verifying downloads or non-security checksums they are fine and fast. But MD5 and SHA-1 are cryptographically broken (collisions are practical), so never use them for passwords, digital signatures or security. Use SHA-256 or SHA-512 there.
Which algorithm should store passwords?
None on this page. MD5/SHA families are built to be FAST — exactly wrong for passwords, where you want deliberate slowness. Use bcrypt, scrypt or argon2 with a per-user salt; they are key-derivation functions, not general digests.
Related tools
What Is a Hash Generator?
A hash function turns any text or file into a fixed-size string — a fingerprint — so you can compare data without exchanging it, verify that a download is intact, or store a checksum instead of the original content. This tool computes MD5, SHA-1, SHA-256, SHA-512, and CRC32 from text or from files up to 100 MB, all five at once, right in the browser. It also supports HMAC (hashing with a secret key), an uppercase toggle, and a verify mode: paste the expected hash and it automatically detects which algorithm matches and highlights that row. It is made for developers, release engineers, and anyone who validates file integrity or checksum-driven workflows.
What this tool can do
- 🔢 MD5, SHA-1, SHA-256, SHA-512, and CRC32 computed simultaneously
- 📄 Text input or file input up to 100 MB, with drag and drop
- 🔑 HMAC mode with your own key
- ✅ Verify mode: paste an expected hash and the matching algorithm is auto-detected
- 🔠 Switch output between lowercase and uppercase
- 📋 One-click copy for every algorithm row
When you will use it
- Verifying a downloaded file against a published checksum
- Checking whether two files are identical without diffing them
- Adding integrity checks to a deployment pipeline
- Testing HMAC signatures while building an API client
Privacy: hashing runs entirely in your browser — even a 100 MB file is processed on your own device and never uploaded. The verify mode is local too.