What is a hash?
A hash function turns any amount of data into a short, fixed-length fingerprint. The same input always gives the same hash, and changing even one character gives a completely different one. That makes hashes useful for checking that a file arrived intact, spotting duplicate files, building cache keys and signing API requests.
Which algorithm should I use?
| Algorithm | Length | Use it for |
|---|---|---|
| MD5 | 128 bits | Quick checksums and legacy systems only. It is broken for security: collisions can be created on a laptop. |
| SHA-1 | 160 bits | Legacy use such as older Git objects. Also broken for signatures since 2017. |
| SHA-256 | 256 bits | The safe default: file checksums, API request signing, blockchain and certificates. |
| SHA-384 / SHA-512 | 384 / 512 bits | When a standard asks for them, or a larger security margin. SHA-512 is often faster than SHA-256 on 64-bit CPUs. |
| CRC32 | 32 bits | Detecting accidental corruption, as in zip, gzip and PNG files. Not a security hash. |
Verify a downloaded file
- Switch to File and drop the file you downloaded.
- Copy the checksum from the publisher's download page, often labelled SHA-256 or in a
.sha256file. - Paste it into Verify a checksum. The matching algorithm lights up green; if nothing matches, the file is corrupt or not the one the publisher released.
The file is read by your browser and never uploaded, so this works for large installers and private documents alike.
HMAC signatures
An HMAC mixes a secret key into the hash, so only someone with the key can produce the same value. Webhook providers such as GitHub, Stripe and Shopify sign their requests with HMAC-SHA256, and many APIs ask you to sign requests the same way. Tick HMAC, enter the key as text, hex or Base64, and paste the exact request body to check a signature while you debug. Remember that the body must match byte for byte, including whitespace and line endings.
Don't hash passwords with these
MD5 and the SHA family are designed to be fast, which is exactly wrong for storing passwords: attackers can try billions of guesses per second. Store passwords with a slow, salted algorithm made for the job: Argon2id, bcrypt or scrypt. Your framework almost certainly has one built in (for example Spring Security's BCryptPasswordEncoder).
Frequently asked questions
Can a hash be reversed to get the original text?
No. Hashes are one-way. But short or common inputs, such as simple passwords, can be found by guessing and comparing, which is why lookup sites can "reverse" some MD5 hashes.
Why is my hash different from another tool's?
Usually the input differs slightly: a trailing newline (many command-line tools add one with echo, so use echo -n), different line endings on Windows, or a different text encoding. This tool hashes the exact UTF-8 bytes of what you type.
How do I get the same result on the command line?
For files: sha256sum file on Linux, shasum -a 256 file on macOS, or certutil -hashfile file SHA256 on Windows. For text: printf %s "text" | sha256sum.
Are my files uploaded?
No. Files are read and hashed inside your browser with the Web Crypto API. Nothing is sent to our server.
Is there a size limit?
Files up to 1 GB can be hashed. Very large files need enough free memory in the browser tab.